Multi-factor authentication (MFA) was built around separating access elements into two categories: “something you know,” such as a password, and “something you have,” such as a physical token or device. That division is now at the center of a cybersecurity debate over whether Time-Based One-Time Password (TOTP) codes belong alongside passwords in an integrated password manager or inside a dedicated authenticator application.
The move toward TOTP followed changes in the way digital services delivered verification codes. Many originally relied on Short Message Service (SMS) text messages, but in 2017 the National Institute of Standards and Technology (NIST) updated its Special Publication 800-63-3 Digital Identity Guidelines and discouraged SMS-based 2FA because of interception risks and “SIM-swapping” attacks, in which bad actors hijack a victim’s phone number. The Internet Engineering Task Force (IETF) had codified the TOTP protocol in 2011 as RFC 6238.
Platforms including Bitwarden, 1Password, and Dashlane now let users store cryptographic TOTP seeds directly inside their vaults. After the primary credentials are entered, the password manager can automatically generate and autofill the six-digit verification codes.
That arrangement removes the need to check a separate physical device before a code expires. Password managers also encrypt and sync vaults across desktop computers, mobile phones, and web browsers, which can protect users from lockout crises when a primary device is lost or damaged.
Dedicated authenticator applications take the opposite approach. Google Authenticator, Microsoft Authenticator, and Duo Mobile generate verification codes locally on a physical device, typically a smartphone, keeping them separate from the password storage layer.
Sharing credentials can also be simpler when both factors are stored in one vault, including for corporate teams or family members who need cooperative access to shared accounts. Cybersecurity purists, however, warn that placing the password and 2FA seed together creates a single point of failure and undermines the core architectural tenet of two-factor security.
If info-stealing malware, such as a browser-based keylogger, is successfully deployed, or if a user’s master vault password is compromised, both security barriers can fall simultaneously. The threat model became concrete during the late 2022 LastPass data breach, when unauthorized actors stole cloud-based backups of customer vault data.
In cases where users had stored passwords and TOTP seeds in the same compromised vaults, attackers who cracked the master passwords gained immediate, total access to those accounts without needing further authentication steps.
Isolation can prevent that type of combined compromise: even when a desktop computer is infected with malware or a password database is breached, an attacker cannot access the account without physical access to the generated offline codes. Historically, however, dedicated authenticator apps offered less operational resilience. Losing or damaging a phone could mean losing the underlying 2FA seeds entirely and being forced through tedious account recovery processes.
Google updated its Authenticator app in 2023 to support cloud synchronization across Google Accounts, addressing the lockout issue. The change also prompted discussions about cloud security and the need for end-to-end encryption for stored seeds, which the company subsequently implemented.
Security agencies and professionals frequently recommend a hybrid operational model to balance usability with defense-in-depth. Users can rely on integrated TOTP generation in password managers for low-risk, everyday accounts, including retail websites, streaming subscriptions, and general online services.
For high-value targets, the 2FA keys for primary email addresses, online banking accounts, and the master password manager vault itself are kept strictly within a dedicated authenticator app or moved onto physical hardware security keys. These include keys using the FIDO2 and WebAuthn standards developed by the FIDO Alliance.
Critical gateway accounts can therefore be segregated from general web credentials while password managers handle other accounts. A breach of one system does not grant a malicious actor complete control over their digital lives.
