Two-step verification codes (TOTP) in your manager

Many websites ask for a six-digit code after your password, and the code changes every 30 seconds. This kind of code is called TOTP. It usually comes from an authenticator app on your phone. Bitwarden and KeePassXC can generate these codes too. To learn what two-step verification is, read the lesson Two-step verification: codes, apps and text messages in the Safe online course.

First, weigh it up

If your password and your code are in the same vault, that vault is all an attacker needs. KeePassXC says so in its documentation too: if you keep the codes in the same database as your passwords, you lose the benefit of two-step verification. For the highest security, keep your codes separate.

• Codes kept separate in an authenticator app or in a second KeePassXC database: more secure.
• Codes in your manager: easier, and still much better than no two-step verification at all. A fake site that has only stolen your password can't get in with it.

Whatever you choose, never store the code for your vault itself inside that vault (see Securing your Bitwarden account with two-step login). And keep the backup codes for important accounts on paper or in a different vault.

In Bitwarden

1. Turn on two-step verification on the website. The website shows a QR code and often a secret key as text as well.
2. In Bitwarden, open the item for that website and choose to edit it.
3. On your phone: tap the camera icon next to the authenticator key and scan the QR code. On your computer: paste the secret key into the Authenticator key (TOTP) field. The browser extension can also read the QR code on the page by itself.
4. Save the item, then enter the code Bitwarden shows on the website to finish.

You can store the key in any account. Showing and filling in the codes is part of the paid versions of Bitwarden (Premium or a paid organisation). After filling in your password, the extension copies the code automatically, so you only need to paste it. A free alternative from Bitwarden is the separate Bitwarden Authenticator app.

In KeePassXC

1. Copy the secret key from the website (the text below or next to the QR code).
2. Right-click the entry and choose TOTP, Set up TOTP.
3. Paste the key and click OK. The default settings are almost always fine.
4. The entry gets a small clock icon. Use Show TOTP or Copy TOTP to use the code. KeePassXC-Browser can also fill it in.

Your computer's clock must be set correctly, otherwise the codes won't work.

At WebOké

My WebOké, DirectAdmin and Nextcloud work with an authenticator app. To set it up, read Using an authenticator app, Setting up two-step authentication and Setting up an authenticator app and keeping backup codes. Keep the backup codes for DirectAdmin and Nextcloud somewhere safe. My WebOké has no recovery codes: if you lose your app, please contact us.