Storing TOTP tokens: Password manager vs. dedicated authenticator app
Multi-factor authentication (MFA) has become a standard security requirement for protecting online accounts. One of the most widely used MFA methods is TOTP (Time-based One-Time Passwords).
As password managers evolve, many now offer built-in TOTP support, raising an important question:
Is it better to store TOTP tokens inside a password manager or to use a dedicated authenticator app?
The answer is not absolute. Each approach has clear advantages and trade-offs. Understanding them helps individuals and organizations make informed security decisions.
1. What are TOTP tokens?
TOTP is a form of one-time password generated using a shared secret and the current time.
Once set up, the user provides:
- A password (something you know), and
- A short-lived numeric code that changes every 30 seconds (something you have).
TOTP is widely used for:
- Email accounts
- Cloud platforms
- VPNs
- Admin dashboards
- Business applications
The security assumption behind MFA is factor separation: even if one factor is compromised, the attacker cannot access the account without the second factor.
2. Storing TOTP tokens in a password manager
How it works
Modern password managers can store the TOTP secret alongside login credentials. When logging in, the manager automatically generates and fills (or copies) the TOTP code.
Advantages
Convenience and usability: Using a single application for both passwords and TOTP significantly simplifies the login process. Users do not need to switch between apps or devices.
Reduced friction and fewer errors: Fewer steps reduce the likelihood of mistakes, lockouts, or users bypassing MFA due to inconvenience.
Centralized backup and recovery: If a phone is lost or replaced, access can be restored through the password manager’s recovery process, which is critical for business continuity.
Higher adoption in teams: For SMEs and non-technical users, usability matters. Storing TOTP in the password manager often leads to better overall MFA adoption.
Disadvantages
Single point of failure: If the password manager vault is compromised, both the password and TOTP token may be exposed at once.
Weaker factor separation: Although still MFA, storing both factors in one container reduces the original security model of “something you know” + “something you have.”
Higher impact of endpoint compromise: Malware or keyloggers on the device running the password manager may gain full access.
3. Using a dedicated authenticator app
How it works
A separate mobile app generates TOTP codes based on stored secrets. The app is usually device-bound and works offline.
Advantages
Strong factor separation: Passwords and TOTP tokens are stored on different devices or apps, maintaining a clearer separation of authentication factors.
Reduced blast radius: If a password is compromised, the attacker still needs access to the authenticator app.
Alignment with Zero Trust principles: Separating authentication factors supports a layered security approach.
Preferred for high-risk accounts: Administrator accounts, production systems, and financial platforms benefit from stricter separation.
Disadvantages
Lower usability: Switching between apps slows down workflows, especially in environments with frequent logins.
Higher risk of lockout: Losing a phone without proper backups can result in permanent account loss.
Manual backup complexity: Users must securely store recovery codes or QR codes, which is often neglected.
Lower adoption among non-technical users: If MFA is perceived as cumbersome, users may resist it or use insecure workarounds.
4. Security comparison: Real-world scenarios
Compromised endpoint
- Password manager TOTP: High impact if the vault is accessible.
- Authenticator app: Attacker still needs access to the separate device.
Phishing attacks
- Both approaches protect against password reuse.
- Neither TOTP method fully prevents real-time phishing unless combined with phishing-resistant MFA (e.g., passkeys or hardware keys).
Device loss
- Password manager TOTP: Easier recovery via account restoration.
- Authenticator app: Recovery depends on backups and recovery codes.
5. Business perspective: SMEs vs. enterprises
SMEs and small teams
Characteristics:
- Limited IT resources
- High need for usability
- Business continuity is critical
For many SMEs, storing TOTP in a password manager provides a pragmatic balance between security and usability, resulting in better overall protection.
Large enterprises
Characteristics:
- Compliance requirements
- Privileged access management
- Higher threat models
Enterprises often enforce dedicated authenticators for admin and critical systems, while allowing password-manager-based TOTP for standard user accounts.
6. Best-practice approach: A hybrid model
A hybrid strategy combines security and usability:
- Low-risk accounts: TOTP stored in the password manager
- High-risk or privileged accounts: Dedicated authenticator app or hardware security key
This risk-based approach allows organizations to apply stronger controls where they matter most.
7. Alternatives beyond TOTP
TOTP is effective, but not perfect. Modern alternatives include:
- Passkeys (FIDO2 / WebAuthn): Phishing-resistant, passwordless
- Hardware security keys: Strong physical second factor
- Push-based authentication: Easier, but not always phishing-resistant
Where supported, these methods can further reduce reliance on TOTP.
8. Decision checklist
Ask yourself:
- How critical is the account?
- What is the threat model?
- How technical are the users?
- How important is recovery and continuity?
- Are there compliance requirements?
9. Conclusion: Context matters more than the tool
There is no universal answer to where TOTP tokens should be stored.
Storing them in a password manager improves usability and adoption, while dedicated authenticator apps provide stronger factor separation.
Security is not about absolutes. It is about choosing controls that fit your risk level, users, and operational reality.
The most secure solution is the one that users actually follow — combined with clear policies, regular reviews, and layered defenses.
Please note that PassSecurium™, our password manager, supports secure TOTP storage and generation.
Business clients can request a live demonstration or a test account, while private users can register for a free personal version directly on our website.