Should You Keep Your 2FA Codes in Your Password Manager?

You have finally turned on two-factor authentication for the accounts that matter. Now every login is a small dance: open the app, type the password, switch to a separate authenticator, read a six-digit code before it changes, switch back, type it in. It works, but the friction is exactly why so many people never finish setting 2FA up in the first place.

Modern password managers offer a tempting shortcut. They can hold your one-time codes alongside each login and fill both together. The convenience is obvious. The worry is just as obvious: if both factors live in the same app, have you quietly turned two locks back into one? The honest answer depends entirely on how that app is built.

What a TOTP code actually is

When you scan a QR code to set up an authenticator, the site hands your device a secret. From then on, your device and the server each run the same clock and the same math to produce a six-digit code that changes every thirty seconds. This is called TOTP, for time-based one-time password. Because the code depends on a secret only your device holds plus the current time, a stolen password alone is not enough to log in. That is the whole value of a second factor.

The catch is that the secret has to live somewhere. A dedicated authenticator app is one home. Your password manager is another. The question is not whether it is stored, but how well the store protects it.

The convenience, stated plainly

When your codes sit next to your logins, the whole login collapses into a single biometric tap. Your vault fills the username, the password, and the current code together, so you never race a thirty-second timer or fumble between two apps. For a lot of people, that convenience is the difference between actually using 2FA everywhere and only turning it on for one or two accounts.

That matters more than it sounds. The most common real-world 2FA failure is not a clever attack. It is people never enabling it because the friction was too high. A manager that makes the second factor effortless quietly raises your security across every account you own.

The "same basket" objection, taken seriously

The strongest argument against this setup is that a true second factor is supposed to be independent. If a password lives in your manager and the 2FA code lives in a separate authenticator, an attacker needs to defeat two different things. Put both in one app and, in theory, cracking that one app hands over everything.

This is a fair point, and it is worth being precise about. The concern is only meaningful if the app itself is weakly protected. So the real question becomes: how hard is your vault to open, and who besides you can open it?

How a well-built vault contains the risk

Three design choices turn "both factors in one app" from a shortcut into a reasonable, even strong, position:

• Zero-knowledge, on-device encryption. If the vault is sealed with a key generated on your device and stored in secure hardware, there is no server copy for an attacker to raid and no maker who can hand your codes over. Compromising the app means compromising your specific unlocked device, not a database somewhere.
• Per-item keys. When every login and every code is encrypted with its own key, no single slip exposes the whole vault at once.
• Biometric gating on every use. If reading a code requires Face ID or Touch ID each time, a glance at an unlocked screen does not leak it, and a thief holding your phone still cannot produce codes.

Kinship Vault is built this way. It stores TOTP secrets encrypted like any other item, and every fill and every 2FA code is gated by Face ID or Touch ID, so the code is revealed only to you and only in the moment you ask for it. You can read how the codes are handled in the two-factor documentation.

The stronger endgame: passkeys

TOTP was a big improvement over passwords alone, but it is not the finish line. A code can still be phished: a convincing fake site can ask you to type your password and your current code, then replay both in real time. Passkeys close that door. A passkey replaces the password with a cryptographic key pair bound to the real website, so there is no shared secret to steal and nothing to type into a fake page. Where a site supports them, a passkey is simply safer than a password plus a code.

The practical path is not either-or. Use passkeys where you can, keep TOTP for the long list of sites that do not offer passkeys yet, and let your vault hold both under one key and one recovery plan. We walk through the passwordless side in our plain-English guide to passkeys.

The best second factor is the one you will actually use on every account, protected by a vault only you can open.

So, should you do it?

For most people, yes, provided the manager is zero-knowledge, encrypts on device, and demands your face or fingerprint for every code. The convenience gets you to full 2FA coverage, and a hardware-sealed, biometric-gated vault keeps the "same basket" risk small. If you are protecting a handful of very high-value accounts and you want maximum separation, keeping those specific codes in a separate authenticator is a defensible choice. Everywhere else, codes in your vault beat 2FA you never finished turning on.