An authentication app generates tokens that can be used as a second verification step after entering a password, thereby providing a second factor of authentication. Hardware tokens are also used, but they are less common and often less convenient than an app. Backup codes are single use and do not continuously provide a second factor. SMS messages were used historically for two-factor authentication but are less secure due to the risk of SIM swapping and interception. An authentication app is the most appropriate and commonly used option among the choices.