Short answer: Putting your 2FA codes on the same computer where you type your passwords weakens the “second device” principle — but for most people it is still far better than not using 2FA, and much better than SMS. The nuance is which accounts: use a desktop or browser authenticator freely for everyday logins, and keep your email, banking and crypto codes on a separate phone. And prefer tools that keep the secret on your phone and merely display codes on the desktop.
The principle, and where it bends
Two-factor authentication assumes the factors are independent. Your password lives in your head or your password manager; your code lives on a device an attacker does not have.
Put both on one laptop and that separation narrows. Malware that steals your browser passwords can plausibly reach your TOTP secrets in the same sweep — and infostealers are specifically built to sweep everything on a machine. See session hijacking for how that class of malware operates.
But hold the purism for a moment. The realistic alternatives for most people are SMS or nothing, and a desktop authenticator beats both comfortably. The question is not “is this perfect” but “is this better than what I would otherwise do”.
The three kinds, ranked
1. Phone-anchored, desktop-displayed (best)
The secret stays on your phone; the desktop extension asks the phone to approve and then fills the code. 2FAS works this way, and it is the smartest design available.
You get desktop convenience without the secret ever touching the computer. If the laptop is compromised, the attacker gets a code that expires in 30 seconds, not a permanent secret.
This is the option to choose if it fits your workflow.
2. Password manager with built-in TOTP (good, with a caveat)
Bitwarden, 1Password, Proton Pass and others store codes alongside passwords and autofill both.
Genuinely convenient, solves the backup problem entirely, and the vault is encrypted. The caveat is concentration: one master password now unlocks both factors. For most accounts that is an acceptable trade; for the critical few it is not. Detailed argument in password managers with built-in TOTP.
3. Standalone desktop or browser-extension authenticators (use carefully)
Applications and extensions that hold TOTP secrets locally on the computer.
The concerns are real: browser extensions have broad access and change hands, extension stores have hosted malicious clones of popular authenticators, and secrets stored on disk are exactly what infostealers look for.
If you use one, choose an established open-source project, check the publisher carefully, and keep your highest-value accounts elsewhere.
A security key beats all of this on a desktop
Worth saying, because it solves the problem rather than balancing it.
A hardware key plugged into your laptop is faster than typing a code, works entirely on the desktop, and keeps the credential in hardware that malware cannot read. It is also phishing-resistant, which no TOTP app is.
If your frustration is “reaching for my phone all day”, a key is a better answer than moving your secrets onto the computer. See which security key to buy and phishing-resistant MFA.
A sensible split
Keep on a separate phone:
- Primary email
- Password manager account
- Banking and payment platforms
- Crypto exchanges — 2FA for crypto
- Domain registrar and hosting
Fine on desktop or in your password manager:
- Social accounts
- Shopping and marketplaces
- Forums, SaaS tools, project management
- Anything you sign into many times a day
The test: if losing this account would cost me money or cascade into other accounts, the code goes on the phone. Gaming accounts sit awkwardly in between, and some run their own scheme — see how to set up 2FA on Battle.net.
If you do use a desktop authenticator
- Full-disk encryption — BitLocker or FileVault, on.
- A short auto-lock and a real login password.
- Keep the machine clean — no cracked software, no unvetted extensions, updates applied.
- Audit browser extensions regularly; remove what you do not use.
- Back it up the same as any authenticator — how to back up your authenticator app.
- Never on a shared or work machine for personal accounts.
Frequently asked questions
Is a browser extension authenticator safe?
It depends heavily on the extension. Established open-source projects with a track record are reasonable for everyday accounts; unknown extensions with generic names are not. Extensions can be sold and updated with new behaviour, so the one you vetted two years ago is not permanently vetted.
Is using my password manager for codes bad practice?
It is a trade, not a mistake. For most accounts the convenience makes people more secure overall. Keep the critical few separate and you have the best of both.
What if my laptop is stolen?
With full-disk encryption and a strong login password, the thief gets nothing. Without encryption, assume both factors are exposed and change everything.
Can I have the same account on my phone and desktop?
Yes — the same secret generates identical codes on any number of devices. That is also a decent backup strategy, though it multiplies where the secret can be stolen from.
Does macOS or Windows have this built in?
Apple’s Passwords app stores verification codes and syncs across Apple devices, which is convenient and carries the same both-factors-together trade-off. Windows leans on Microsoft Authenticator and passkeys via Windows Hello.
What is the best setup overall?
Security keys or passkeys where supported, an authenticator on your phone for everything else, and a desktop or password manager option for the high-frequency low-stakes accounts that would otherwise wear you down.
The bottom line
Desktop authenticators trade some separation for real convenience, and convenience keeps people using 2FA at all. Take the trade for everyday accounts, keep your email and money on a separate phone, and if the friction is what is bothering you, buy a security key — it removes the problem instead of relocating it.
Choosing a phone app first? See best 2FA apps for Android and for iPhone.