What a password manager does
A password manager is an encrypted store for the things you would otherwise have to remember: passwords, and usually secure notes, card numbers and other secrets too. You unlock it with one master password, or your fingerprint or face, and it fills each site’s password in for you.
Its real value is that you stop reusing passwords. It can generate a long random password for every account, and because you never type or remember them, there is no cost to making each one different. When one site is breached, the leaked password opens that site and nothing else.
- Stores passwords and other secrets, encrypted, synced across your devices.
- Generates a different strong password for every account.
- Fills them in, so you only remember one master password.
- Protects you against breaches and password reuse. On its own, it does nothing once a password has been stolen.
What an authenticator app does
An authenticator app holds the second factor for your accounts. When you turn on two-factor authentication, the site gives the app a secret by QR code, and from then on the app shows a new six-digit code for that account every 30 seconds. Some apps can also approve a sign-in with a tap.
It stores no passwords. Its whole job is to prove that you have your phone, so that someone who has your password still cannot get in. Because the codes are made on the phone from the secret and the clock, they work with no signal and nothing is sent at sign-in. Our explainer on what 2FA is covers how the codes work and how they compare with SMS and passkeys.
- Generates one-time codes (TOTP), or approves sign-in prompts, for accounts with 2FA turned on.
- Stores the 2FA secret for each account, not the password.
- Protects you after a password has leaked or been phished into a fake form, as long as the attacker does not also get the code.
- Does nothing for an account where 2FA is switched off.
Password manager vs authenticator, side by side
The easiest way to keep them apart: the password manager looks after something you know, and the authenticator is something you have. A sign-in with 2FA asks for one of each.
- What it holds: the password manager holds passwords; the authenticator holds 2FA secrets and shows codes.
- When you use it: the password manager at the first step of signing in; the authenticator at the second step.
- What it stops: the password manager stops reuse and weak passwords; the authenticator stops a stolen password from being enough.
- Where it lives: a password manager syncs to every device you use; an authenticator usually lives on your phone, with an optional backup.
- What losing it costs: losing the password manager means resetting passwords; losing the authenticator with no backup means recovering each account with its backup codes.
Do you need both?
For your important accounts, yes. They cover different failures. A password manager makes sure a breach at one site does not hand over your other accounts, but if a password is phished or copied off a device, it is still a working password. An authenticator stops that working password from being enough on its own, but it cannot stop you reusing one weak password everywhere.
Start with the accounts that can reset the others: your email first, then your phone account (Apple or Google), banking, and anything work-related. Those get a unique password from the password manager and 2FA from the authenticator. Everything else can follow over time.
Can one app do both?
Yes. Many password managers, including Bitwarden, 1Password and Proton Pass, can store a login’s 2FA secret next to its password and fill in the code as well. People search for this as a “password manager with a built-in authenticator”, and the appeal is real: one app to set up, one backup, one thing to move to a new phone, and the code filled in for you.
The cost is that both factors then sit in one store. Anything that opens the vault (a phished master password, a compromised browser extension, an unlocked laptop) gives up the password and the code together, so the second factor no longer protects you against the attacks that take the vault. Some vendors offer both ways: Bitwarden, for example, also has a separate, free Bitwarden Authenticator app that needs no Bitwarden account.
Neither choice is wrong. Codes in the password manager are far better than no 2FA at all. If you want the two factors to fail separately, keep them in separate apps. Our longer post on whether a password manager should store your 2FA codes goes through the trade-off, including the cases where keeping them together is the right call.
Is Microsoft Authenticator a password manager?
Not any more. Microsoft Authenticator used to save and autofill passwords on your phone, and Microsoft removed that in 2025: the app stopped saving new passwords in June, stopped autofilling in July, and removed saved passwords from the app in August. Payment cards saved in it were deleted rather than moved.
Passwords saved to a personal Microsoft account were not lost. They now live in Microsoft Password Manager, which is part of the Edge browser, and Microsoft points people to Edge for autofill on the phone. If you searched “Microsoft Authenticator password manager gone”, that is where your passwords are: in Edge, signed in with the same Microsoft account.
Microsoft Authenticator is still an authenticator. It still makes 2FA codes and approves sign-ins for Microsoft and other accounts. Only the password side moved.
Google Password Manager vs Google Authenticator
They are separate products that happen to share a name. Google Password Manager is built into Chrome and Android and saves the passwords you type into sites. Google Authenticator is a phone app that makes 2FA codes. Saving a password in one does nothing in the other.
One thing worth knowing: since April 2023, Google Authenticator can sync your 2FA codes to your Google Account. If your passwords are also saved in Google Password Manager under that same account, then one Google sign-in gives up both, which is the same one-store problem as above. Turning sync off keeps the codes on the phone only, so in that case turn on another backup or keep each site’s backup codes.
How U2 Secured splits them
U2 Secured is two products, kept apart on purpose. The Password Vault stores passwords, secure notes, cards, API keys and other secrets, encrypted on your device before anything is uploaded. It has no field for 2FA secrets. When you import from Bitwarden, LastPass, 1Password or Chrome, any 2FA secrets in the file are handed back to you as QR codes to scan into an authenticator app, never stored in the vault.
The U2 Secured Authenticator, for iPhone and Android, makes the codes. They are free and unlimited, in the separate u2 secured authenticator app — not stored in the vault. Premium, at $14.99 a year, adds a zero-knowledge, end-to-end-encrypted backup (we store only ciphertext and never hold the key), restore on a new phone and the web portal, never the codes themselves.
Both have a free plan: the vault for 1 user and 500 items, the Authenticator with unlimited codes. You do not have to use both from us; the split is the point, not our apps. Any authenticator works with the vault, and the Authenticator works with any password manager.