Short answer: Password managers with built-in TOTP — Bitwarden, 1Password, Proton Pass, Dashlane, Keeper — let you store passwords and generate 2FA codes in one app, with autofill for both. It is far more convenient and it means your codes survive device loss. The trade-off is real: putting both factors in one vault means a single compromise gives an attacker everything.
The convenience case
A password manager with TOTP autofills your password and your six-digit code in one action. No reaching for a phone, no squinting at a timer, no retyping because the window expired.
It also solves the problem that breaks most people’s 2FA setup: backup. Your TOTP secrets are stored in an encrypted vault that syncs across devices. Lose your phone and everything is still there on your laptop. Compare that to a standalone app where a lost phone can mean weeks of account recovery — see what happens when you lose a 2FA phone.
For anyone managing thirty or forty accounts, the time saved is not trivial.
The security objection — stated honestly
Two-factor authentication assumes your two factors are separate. Something you know, something you have. Put both in one vault and you arguably have one factor stored twice.
If someone obtains your master password and gets past your vault’s own 2FA, they hold your passwords and your codes together. There is no second obstacle.
How much this matters depends on the threat you are guarding against:
- Against phishing and credential stuffing — which is what actually happens to most people — a password manager with TOTP is a large improvement over reused passwords and no 2FA at all.
- Against a targeted attacker who compromises your device — separation genuinely matters, and a separate phone app or hardware key is better.
Neither approach stops a real-time phishing page. That limitation applies to all TOTP everywhere, as we explain in how TOTP codes work.
The options compared
| Manager | TOTP included in | Notable |
|---|---|---|
| Bitwarden | Paid tier (inexpensive) | Open source, self-hostable, audited |
| 1Password | All plans | Best autofill polish; Travel Mode |
| Proton Pass | Free and paid | TOTP on the free tier; strong privacy focus |
| Dashlane | Paid plans | Bundled VPN; browser-first |
| Keeper | Paid add-on | Strong enterprise controls |
| Apple Passwords | Built into iOS/macOS | Free, seamless — Apple ecosystem only |
All implement the same standard, so codes are identical across them. Choose on export ability, platform coverage, and price rather than on the code generation itself.
The sensible middle path
You do not have to pick one approach for everything. Split by value:
Password manager TOTP is fine for shopping sites, forums, streaming services, SaaS tools, work dashboards, and the long tail of accounts where a breach is annoying rather than catastrophic.
Keep these separate — on a dedicated phone app or, better, a hardware key:
- Your primary email, since it can reset everything else
- The password manager’s own account
- Banking and crypto exchanges — see our Coinbase guide
- Your domain registrar and hosting
This gives you convenience where it costs nothing and separation where it matters.
Three rules if you do this
- Never store your password manager’s own 2FA inside itself. Locked out of the vault means locked out of the code needed to open the vault. Keep those codes on paper — see where to store backup codes.
- Protect the vault with a hardware key or passkey. Everything now depends on this one account. See hardware security keys explained.
- Check you can export. Before committing forty accounts, confirm the manager will let you take your TOTP secrets elsewhere. Lock-in is the problem that makes leaving cost a weekend — the same issue we flagged in our Authy comparison.
Frequently asked questions
Is it safe to store 2FA codes in a password manager?
For most accounts, yes — it is a substantial improvement over no 2FA. For your email, finances, and the vault itself, keep the second factor on separate hardware.
Does this defeat the purpose of two-factor authentication?
Partly. You lose device separation but keep protection against password breaches, credential stuffing, and bulk automated attacks — which cause the overwhelming majority of account takeovers.
Can I use one for some accounts and an app for others?
Yes, and that is the recommended approach. Split by what each account is worth.
What if the password manager company is breached?
Reputable managers use zero-knowledge encryption, so the provider cannot read your vault and neither can an attacker without your master password. A weak master password is the real risk.
Do passkeys change this?
Yes, increasingly. Most managers now store passkeys too, which are phishing-resistant in a way TOTP is not. Use them where offered — see passkeys vs 2FA.
The bottom line
The security purists are right in principle and often wrong in practice, because the alternative most people choose is not a separate app — it is no 2FA at all. A password manager that makes 2FA effortless on forty accounts beats a perfect setup on three. Just keep your email, your money, and the vault itself on separate hardware.
2 Responses