2FA Codes, Built In: Two-Factor Authentication Next to Every Password

Two-factor authentication is the single best upgrade most accounts can get. A stolen password stops being enough, because the thief also needs a code that changes every 30 seconds. The trouble is the ritual: type the password, unlock your phone, open the authenticator, scroll to the right account, squint at six digits, type them before the ring runs out.

Kinship Vault removes the ritual and keeps the protection. Each login can hold its own 2FA setup key, the secret your authenticator app uses to make codes, and the vault turns it into the live code right where you already are: on the login's page, in AutoFill, and in the browser extension.

What a 2FA code actually is

When a site offers "authenticator app" two-factor, it shows you a QR code. Inside it is a short shared secret plus a few settings, packed into a link that starts with otpauth://totp/. The site keeps a copy of that secret; your app keeps the other. Every 30 seconds both sides feed the secret and the current time through the same formula (TOTP, standardised as RFC 6238) and get the same six digits. Nothing travels between them at login time, which is why the code works on a plane and why it cannot be intercepted on its way to you the way an SMS can.

That also tells you what matters: the secret is the thing to protect. Whoever holds it can make your codes. In Kinship Vault it is stored encrypted, in the same per-item encrypted record as the password, and it is unlocked only by your Face ID, Touch ID, fingerprint or PIN.

Adding a code: four ways in

1. Scan the site's QR

Open the login, and in the Two-factor codes card choose Scan QR code. Point the camera at the code the website shows during setup. On a Mac, the scanner uses the built-in camera, so you can scan a QR shown on your phone, or hold a printed backup sheet up to the screen. If you do not have the login saved yet, use Add a 2FA code from the Passwords menu: Kinship Vault offers the logins that match the site, or Save as a new login.

2. Paste the setup key

Most sites also show a "can't scan?" text key. Choose Enter setup key and paste it, either the bare base32 key or the whole otpauth:// link. A link carries its own settings, so you never have to pick an algorithm by hand.

3. Import from Google Authenticator

Moving from Google Authenticator does not mean re-enrolling every account. In Google Authenticator choose Transfer accounts → Export accounts, then in Kinship Vault choose Passwords → Import → Import from Google Authenticator and scan. Large exports are split across several QR codes; scan each one. Codes you already have are not added twice, and the import tells you what it skipped. If you accidentally scan a transfer QR in the ordinary 2FA scanner, the app recognises it and points you to the import instead of saving something broken.

4. Import with your passwords

If your old password manager stored codes, they come along in the same CSV import as your passwords: Kinship Vault reads the otpauth, totp, login_totp and otp columns that Apple Passwords, 1Password, LastPass, Bitwarden and the Chromium browsers write. On iOS 26, the system's credential exchange between password managers carries the codes too.

Filling the code, without the ritual

A stored code is only half the point. The other half is never typing it.

• iPhone, iPad and Mac. On iOS 18 and macOS 15 or later, Kinship Vault registers every login that has a code with the system's one-time code AutoFill. When a site asks for the code, it appears above the keyboard; one Face ID or Touch ID later it is filled. When you fill the password for a login with a code, the code is also copied, ready for the next page, and a notice shows it with its countdown and waits for you to tap Continue. If the current code has under 8 seconds left, you get the next one instead, so it does not expire while the page loads.
• Android. Kinship Vault's AutoFill service recognises one-time code fields and fills the current code straight into them. When a page has no code field yet, it copies the code and tells you: "2FA code copied to the clipboard".
• The browser extension (Chrome, Edge, Brave, Firefox and Safari) shows Fill 2FA code on code fields. Otherwise it copies the code and clears it from the clipboard when the code lapses.

The clipboard is treated like a secret

Codes are short-lived, but the clipboard is not, so Kinship Vault limits where a copied code can go. On iPhone and iPad a copied code stays on that device only (it never rides Universal Clipboard to your other devices) and expires after 90 seconds by default. On Android the copy is marked sensitive, so the keyboard's clipboard preview hides it, and it is cleared when the code expires, but only if the clipboard still holds that code, so it never wipes something you copied afterwards.

Find the accounts that still need it

Security Checkup counts how many of your logins have a 2FA code and lists the ones marked No two-factor. Each one has an Add 2FA button that opens the scanner for that exact login, so turning on two-factor for your most important accounts becomes a short checklist rather than a project. In the password list, the Codes filter shows every login that already has one, and each row's menu has Copy 2FA Code.

What is supported, precisely

Should the code live next to the password?

It is a fair question, and we wrote a whole piece on it: should you store 2FA codes in a password manager? The short version: two-factor exists mainly to stop remote attackers who have your password from a breach or a phishing page. A code in an encrypted vault that only opens with your face or fingerprint, on your own device, still stops them, because they have neither the device nor the biometric. What it trades away is protection against someone who already holds your unlocked phone. If that is your threat for a particular account, keep that one account's code in a separate authenticator; Kinship Vault never forces the choice.