What putting TOTP in the vault actually buys you
It is worth being precise about the upside, because it is real and most arguments against vault-stored TOTP skip it.
One app means one thing to set up, one thing to back up, and one thing to move to a new phone. The vault can autofill the password and the code in the same gesture, so the slowest part of signing in stops being slow. And there is exactly one recovery story to understand instead of two — which, for someone who has never thought about what happens when their phone falls in a river, is not a small thing.
- One setup, one backup, one migration when the phone changes.
- Autofill can supply the password and the code in a single step.
- One recovery story rather than two — fewer ways to lock yourself out.
- Codes sync to every device the vault syncs to, for free.
Why one store is not two factors
Two-factor authentication works because the two factors fail independently. Someone who learns your password should still be stopped, because the second factor lives somewhere the password did not.
A TOTP secret in the vault removes that independence. It is not a claim about encryption strength — the seed is encrypted exactly as well as the password next to it. It is a claim about blast radius. Anything that opens the vault opens both: a phished master password, a malicious or compromised browser extension, a device left unlocked, a session token lifted from a machine with malware on it. In each of those cases the attacker does not need to beat your second factor, because your second factor is in the box they just opened.
The strongest version of this is the one a security reviewer will put to you: if losing the vault loses both factors, what did the second factor add? On the phishing path it still adds something real, since a phishing page that captures a password does not capture the vault. But against anything that takes the vault itself, it adds nothing at all.
This is an argument about where secrets are STORED, not about which device they sit on. Two apps on one phone are still one device, and a phone that is unlocked and compromised is a bad day either way. Separation limits what a single compromised STORE gives up; it is not a claim that one handset is two factors.
Where the industry actually stands
Two things are true at once here, and the second one surprised us when we went and checked.
First, storing TOTP in the vault is the norm. Bitwarden, Proton Pass and 1Password all keep the seed in the same record as the password. Second, all of them put it behind payment. Bitwarden puts the authenticator behind Premium. Proton labels it a paid feature in its own comparison table. 1Password has no free tier for it to be gated from. LastPass is the outlier in the other direction: its TOTP-in-vault row is a business-plan feature, not a consumer one.
So the feature that collapses your two factors into one store is, across the market, the feature you pay extra for. We would rather give the codes away in a place that keeps them separate. Every claim in this paragraph links to the vendor’s own page at the foot of this post — please check them rather than taking our word for it.
What we do instead
U2 Secured is two products. The vault stores passwords, secure notes, cards, API keys, SSH keys and the rest of it. The U2 Secured Authenticator stores TOTP secrets and does tap-to-approve push. The Authenticator's codes are free and unlimited, in the separate u2 secured authenticator app — not stored in the vault — unlimited accounts, no payment, no account tier that unlocks them.
Its Premium tier ($14.99/year) exists, and it is worth being exact about what it gates: encrypted backup and restore, moving your codes to a new device, and the web portal. Not the codes. Generating one-time passwords is free forever, because a second factor you can lose when a subscription lapses is not a second factor anyone should build a security model on.
The vault has no TOTP field at all, and this is enforced rather than merely intended — including on the path where it would have been easiest to give in. Importing from Bitwarden, LastPass, 1Password or Chrome brings a per-login TOTP seed with it. Our importer detects those seeds, counts them in the pre-flight, and hands them over after the import as standard otpauth:// QR codes for you to scan into the Authenticator, or into any other TOTP app you already trust. It never writes them into the vault, and never drops one silently.
When keeping them together is the right call
We would rather say this plainly than have you find the gap yourself.
If the realistic alternative is no second factor at all, then TOTP in your password manager is better than nothing, by a wide margin. An account with a vault-stored second factor beats an account with only a password on every threat that matters to most people, phishing included. “Perfect” is not the bar here; “actually switched on” is.
There is also a real cost to our way, and it is the one we take most seriously: two apps means two recovery stories. If you set up the Authenticator and never enable backup, a lost phone is a lost set of codes, and you are back to the account recovery queue of every site you enrolled. Whichever product you choose, write down the recovery material and store it somewhere that is not the device.
- No second factor today, and one app is what you will actually keep using — take the vault-stored codes.
- Shared team logins where the codes must be available to whoever is on shift — one store is the simpler operational answer.
- You already run a separate authenticator and it works — nothing here is a reason to change it. The split is the point, not our app.
Splitting them, without locking yourself out
If you decide to separate the two, the order matters. Do not delete anything until the new app is producing codes that a site actually accepts.
- Install the Authenticator and add one account to it — not all of them. Sign in to that site with the new code and confirm it works.
- Where a site offers it, re-enrol rather than copying the seed across. Re-enrolling rotates the secret, so an old copy in an old vault stops being useful.
- Regenerate and re-save that site’s recovery codes while you are in there. They are the thing that saves you, and most people have never read them.
- Only then remove the TOTP secret from the vault entry, and repeat for the next account.
- Turn on encrypted backup in the Authenticator before you own more than a handful of codes.
Never remove a code from your old app until the new one has signed you in successfully. A code that works “in the app” but has not been tested against the site is not yet a working second factor.