Best: use a password vault and a separate physical 2FA device such as a YubiKey.Better still: use a password vault and a separate 2FA method (i.e., Google Authenticator or compatible app).Better: use a password vault and 2FA, keeping your 2FA tokens in the vault.If anyone ever discovers your password by other means, your account is still securely protected. Even if a hacker was to breach the provider (BitWarden, LastPass, whomever else) they could not gain access to this information.Īnd the second factor remains in force. Not only do we tend to be more careful with our vault’s security, but there are multiple steps in place to prevent someone from randomly gaining access. The good news is that this is highly unlikely. In theory, if someone were to gain access to your vault, it would give them the first and second factors (passwords and two-factor codes). That means the vault software could enter your user ID, your password, and the current two-factor code for you automatically.

But they take it a step further.įirst, for an appropriately configured account, the vault knows: Password vaults like Bitwarden and (some versions of) LastPass (shown above) have incorporated the open-source Google Authenticator algorithm so that they can also act as your second factor. (It’s also possible for you to display the key in text form in case you’re unable to scan a QR code). Some password vaults have taken steps to make this a little easier. Thus, two factors are required to sign in: Your ability to enter the correct code at the correct time proves you are in possession of your second factor: your phone. It’s not random it’s the result of an encryption algorithm involving the secret key.

The authenticator application displays a random-looking number that changes every 30 seconds. The process is simple: you set up two-factor by pairing your smartphone with your account, usually by scanning a QR-code that contains a secret key. More commonly, it’s the Google-Authenticator compatible two-factor authentication mechanism. TOTP stands for Time-based One-Time Password. While there’s a tiny (tiny!) additional risk in keeping your two-factor keys in your password vault, it’s totally worth it if it gets you to use two-factor authentication more consistently. Password vaults that offer to act as your second factor, perhaps even automatically entering the two-factor code for you as you sign in, make two-factor easier to use. Password vaults and two-factor authentication

2fa bitwarden