Two-Factor Authentication, Built In

Google Authenticator and Authy store TOTP seeds locally (or with limited cloud backup). Lose your phone, change phones, factory-reset, and you lose access to every account those codes protect. Recovery is per-account: contact support, prove identity, regenerate.

Storing TOTP seeds in your password vault makes them part of your normal backup story. Sync covers them, recovery kits cover them, and switching phones is a non-event — sign in to PassCryp on the new phone and your codes are there.

Security professionals split on this. The classical 2FA argument is 'something you know + something you have' — splitting password (in vault) and TOTP (on phone) means a compromised vault still requires a second device.

The counter-argument: a compromised vault means the attacker has unlocked your vault, which requires your master password. If they have your master password, your account security has already failed in a way 2FA-on-a-second-device won't save you from.

The pragmatic answer: keeping TOTP in PassCryp is much better than having no 2FA at all, which is what happens when authenticator apps become annoying. The strongest setup is hardware keys (YubiKey, etc.) for your most sensitive accounts plus TOTP-in-vault for everything else.

When a site offers 2FA setup, scan the QR code with PassCryp's built-in scanner (browser extension or mobile app). The seed is parsed, encrypted, and stored on the matching vault item. From then on, the 6-digit code displays next to the password.

For Google Authenticator migration, open Authenticator → Transfer Accounts → Export. Scan the migration QR with PassCryp. Every seed imports in one step.

For high-value accounts (your email, banking, primary cloud provider), pair PassCryp TOTP with a hardware key for defense in depth.