Most password managers will now generate your two-factor codes as well. Bitwarden, 1Password, Proton Pass and Apple's Passwords app can all store the secret behind a TOTP code and fill the code in at login. For a lot of people, that is the moment two-factor authentication stops being a chore.
It also means both factors for an account now sit in one place. Whether that matters depends on what you are defending against. The honest answer is that it is a real trade-off, with reasonable people on both sides. We make a standalone authenticator, so you should expect us to have a view. We will argue the other side properly first.
What "two factors" was supposed to mean
Two-factor authentication asks for two different kinds of proof, typically something you know (a password) and something you have (a device that holds a secret). The point is that an attacker who gets one is still stuck.
When the TOTP secret lives in the same vault as the password, an attacker who opens the vault gets both. For that account, two factors have collapsed into one: the vault. The vault is usually well protected, by a strong master password and its own two-factor sign-in, but it is now the single thing standing between an attacker and the account.
The case for keeping them together
Autofill is a phishing defence. A password manager normally fills a login only on the site it was saved for. On a convincing fake of your bank's login page, nothing gets filled, and that missing autofill is often the only warning a person gets. When the TOTP code is filled the same way, it inherits the same check. A separate authenticator app has no idea which site you are on; it will happily show you the code while you type it into a phishing page. Neither SMS nor app codes are phishing-resistant on their own, and NIST's SP 800-63B-4 says so in as many words, so a domain check from somewhere is worth having.
Convenience decides whether 2FA gets turned on at all. Every extra step is a reason to skip it on the next account. If storing codes in the password manager means you enable 2FA on forty accounts instead of four, you are almost certainly safer overall. It removes a small class of mistake too: a code copied by hand can arrive with a trailing space or a stray character in a field that forgives neither, which is one of the first things to rule out when a 2FA code is refused.
The commonest attack is still stopped. The attack 2FA was built for is a password leaked from somewhere else and tried everywhere. TOTP in a password manager defeats that completely: the attacker has your password from a breach dump, not the TOTP secret from your vault.
One thing to back up. Keeping two systems recoverable is more work than one, and an authenticator you never back up is a risk of its own.
Here is what each of the four documents, so you can see the feature for yourself: Bitwarden's integrated authenticator, 1Password's one-time passwords, Proton Pass two-factor codes and Apple's verification codes on iPhone. Which plans include the feature varies between them and changes over time, so check yours.
The case for keeping them apart
A vault compromise becomes an account compromise. If someone gets into your password vault, whether through a phished master password, malware reading an unlocked vault, or a weak master password against a stolen vault file, separate 2FA codes are the layer that still holds for each account. Combined, there is no second layer.
Your sync account is a single door. Password managers sync through an account with the provider. That account is usually designed and defended well, and it is still one account whose takeover yields everything. Splitting factors across two systems means an attacker has to beat two different sign-ins, ideally with two different recovery paths.
The password manager's own 2FA cannot live inside it. This one is not a matter of taste. The second factor that protects your password vault has to be somewhere else, or you have locked the key inside the box. The same goes for your primary email if it can reset the password manager.
Recovery codes count too. If you separate an account, its recovery codes are also a second factor. Keeping them in the password manager entry for that account quietly puts both factors back in one place. Paper, or an encrypted file kept elsewhere, keeps the split real.
It is worth being exact about what separation does not buy. If malware controls the device you are using while both apps are unlocked, it can read both. Separating factors protects you from the compromise of one vault or one account, not from the compromise of the machine in front of you.
Who should separate
- Everyone, for the password manager itself and the email account that can reset it. Not optional.
- People with high-value accounts: banking, crypto, domain registrars, cloud consoles, the admin accounts for a business. These are where attackers spend effort, and where a second, independent layer earns its friction.
- People who share a password vault with family or colleagues. Everyone with access to that vault also has the codes for everything in it.
- People who might be targeted personally, rather than swept up in bulk attacks. Assume a determined attacker will try the vault.
Who reasonably should not bother
- People for whom a separate app means no 2FA. Combined 2FA beats absent 2FA, every time.
- Low-stakes accounts. A forum login, a shopping account with no saved card. Convenience wins.
- Accounts already protected by a passkey or security key. A phishing-resistant credential makes the TOTP question matter much less for that account.
A middle path that works
You do not need one rule for everything. A split by tier is where most careful people end up:
- Tier one, separate. Password manager, primary email, banking, registrar, cloud and admin accounts. TOTP in a dedicated authenticator, recovery codes on paper or in an encrypted file somewhere else.
- Tier two, either. Everything else you care about. Combined is fine if it is what gets 2FA switched on.
- Passkeys or security keys wherever they are offered, on top of either, for the phishing resistance that neither approach has on its own. Our post on passkeys versus authenticator apps goes into that.
Whichever you choose, back up the authenticator. Separation only helps if losing a phone does not lock you out of the very accounts you separated. 2FA backup and sync covers how.
Takeaway
Keeping 2FA codes in your password manager is a reasonable choice. It trades a second independent layer for convenience and domain-checked autofill, and for most accounts that trade is fine. For the password manager itself, your primary email, and anything an attacker would target on purpose, keep the second factor somewhere else, and keep those recovery codes somewhere else too.
Where KeyNesta fits
KeyNesta is a "somewhere else". It is an authenticator, not a password manager, and it suits the tier-one codes you would rather not keep next to your passwords: separate vaults with their own passphrases for things that must stay genuinely apart, and end-to-end encrypted sync that we cannot read. It is fair to say what it does not do. There is no browser extension, so it does not fill codes or check the domain for you; you copy the code yourself. If that domain check is what you value most, add a passkey where one is offered. The security architecture page has the details, and the web app at app.keynesta.com needs no sign-up.