Chapter 2 · 2.3
Securing your Bitwarden account with two-step login
With two-step login, Bitwarden asks for a second proof when you log in, on top of your master password, such as a code from an app on your phone. Even if someone finds out your master password, they still can't log in. To learn what two-step verification is and which type is the safest, read the lesson Two-step verification: codes, apps and text messages in the Safe online course.
Which methods can you choose?
| Method | Free account | Note |
|---|---|---|
| Security key or passkey (FIDO2 WebAuthn) | Yes | The strongest: it doesn't work on a fake site. Register at least two keys. |
| Authenticator app | Yes | An app that creates a new six-digit code every 30 seconds. |
| Yes | Less strong: anyone who can read your email also gets the code. | |
| Duo and YubiKey OTP | No, paid plans only |
Without two-step login, Bitwarden emails you a code when you log in on a new device. That's a safety net, not a replacement.
How to turn it on
- Log in to your vault's website (vault.bitwarden.eu). You can't do this in the browser extension.
- Go to Settings, then Security and the Two-step login tab.
- Choose a method, for example Authenticator app, and enter your master password.
- Scan the QR code with your authenticator app and enter the code from the app to confirm.
- Click View recovery code. Write the code down or print it, and keep it with the paper holding your master password.
The recovery code
If you lose your phone or security key, you can get in with your master password and the recovery code. Bitwarden then turns off all your two-step login methods, and you set them up again afterwards. Once you've used it, you get a new recovery code: store it straight away.
Please note: Bitwarden itself warns that without a recovery code you can lock yourself out for good, and customer support won't be able to help you.
Don't store the code for your vault in your vault
The code for logging in to Bitwarden itself belongs in a separate authenticator app, not in Bitwarden. Otherwise you'd need your vault to open your vault. For your other accounts, Bitwarden can store the codes just fine (see Two-step verification codes (TOTP) in your manager).