Two-step verification codes (TOTP) in your manager

Many websites ask for a six-digit code after your password, and that code changes every 30 seconds. This kind of code is called TOTP. It usually comes from an authenticator app on your phone, but Proton Pass and 1Password can generate these codes too. To learn what two-step verification is, read the lesson Two-step verification: codes, apps and text messages in the Safe online course.

Something to weigh up first

If your password and your code are in the same vault, that vault is all an attacker needs. For maximum security, keep the codes separate.

• Codes kept separately in an authenticator app on your phone: more secure.
• Codes in your manager: easier, and still much better than no two-step verification at all. A fake site that has only stolen your password still can't get in.

Whatever you choose, never store the code for your vault itself in that vault. Proton and 1Password both say so (see Securing Proton Pass: two-step login, extra password and locking and Installing and securing 1Password on all your devices). Also keep the backup codes for important accounts on paper or in another place.

What does it cost?

If you go back to the free version of Proton Pass, only the first 3 logins with a code will still show that code.

In Proton Pass

1. Turn on two-step verification on the website. The website shows a QR code. Choose the option to enter the key manually, and you'll see the secret key as text. Copy it.
2. In Proton Pass, open the login for that website and choose to edit it.
3. Paste the key into the 2FA secret key (TOTP) field. On your phone, you can also scan the QR code with the camera.
4. Choose Save. Enter the code Proton Pass shows on the website to finish.

When you log in after that, the extension shows the code with a button to copy and fill it in. After autofilling your password, Proton Pass also copies the code to the clipboard, so all you have to do is paste it. On an iPhone, you turn this on yourself under Profile.

In 1Password

1Password calls this kind of code a one-time password.

1. Turn on two-step verification on the website, so the QR code is on your screen.
2. In the browser extension: open the item for that website, click the three dots and choose to scan the QR code. 1Password reads the code from your screen.
3. In the program or the app: open the item, choose to edit it and add a one-time password field. Scan the QR code with your camera, or paste the secret key as text.
4. Save the item and enter the code 1Password shows on the website.

On your computer, 1Password fills in the code automatically after your username and password. On an iPhone, the code appears above the keyboard. On Android, you copy the code. In the app settings, you can have 1Password copy the code automatically.

Code not working? Check that the date and time on your device are correct.

At WebOké

My WebOké, DirectAdmin and Nextcloud work with an authenticator app. To set it up, read Using an authenticator app, Setting up Two-Step Authentication and Setting up an authenticator app and keeping backup codes. Keep the backup codes for DirectAdmin and Nextcloud safe. My WebOké has no recovery codes: if you lose your app, please contact us.