This is about the vault login, not the codes inside it
A password manager can store two-factor codes for your other accounts. This guide is about something different: the second factor that protects the password manager account itself. If someone learns your master password, this is what stops them from signing in on their own device.
Keep that factor outside the vault. 1Password says plainly that storing your 1Password two-factor codes in 1Password would be like putting the key to a safe inside the safe itself. The same logic applies to a recovery code: if it only exists inside the vault, it cannot help you get into the vault.
Supported sign-in factors at a glance
NordPass is not covered here: its multi-factor authentication options were not verified from vendor documentation for this guide, and only methods confirmed in vendor documentation are included.
| Method | Bitwarden | 1Password |
|---|---|---|
| Authenticator app (six-digit code) | Free for all users | Supported; built-in two-factor is included with every subscription |
| Email code | Free for all users; not recommended with login with SSO | Not listed as a two-factor option on its help page |
| Security key (FIDO2 or U2F, such as YubiKey or Titan) | FIDO2 WebAuthn free; up to 5 keys, or 10 on Premium | Supported; needs a FIDO U2F-compatible key with U2F turned on |
| YubiKey OTP mode | Requires Premium | Not listed |
| Duo | Personal Duo requires Premium; organization Duo requires Teams or Enterprise | Set up by an owner or administrator for the whole organization; Duo itself is not included with the 1Password subscription |
| Recovery code | One code; using it turns off all two-step methods | Individual and family accounts only; resets Secret Key and password but leaves two-factor on |
| Admin or organizer reset | Enterprise account recovery can reset two-step login | Family organizer or team admin recovery resets two-factor |
Bitwarden: free methods, priority order and the recovery code
Bitwarden lets you turn on as many two-step methods as you like. When several are active it asks for the highest-priority one first, in this order: Duo for organizations, FIDO2 WebAuthn, YubiKey, personal Duo, authenticator app, then email. A link on the login screen lets you choose a lower-priority method instead, which is why adding a second method is the cheapest insurance you can buy.
Security keys are free. Any account can register up to five FIDO2 WebAuthn keys and a Premium account up to ten. They work in the web vault and browser extensions on a FIDO2-supported browser, in the desktop apps, and in the Android and iOS 13.3+ apps. Bitwarden notes that Touch ID on macOS is not supported as a key, that Windows Hello will not let a passkey serve as both login and second factor, and that it is phasing out keys migrated from the old U2F format, which should be removed and re-registered.
The recovery code is created when you turn on your first method and is found in the web app under Settings, Security, Two-step login, View recovery code. Using it deactivates every two-step method on the account, except Duo enforced by an organization, and Bitwarden then generates a new code. If you do not set a method up again, Bitwarden emails a verification code when you log in from an unrecognized device.
If you lose your factor and the recovery code, the options are narrow: another method you set up, an Enterprise account recovery reset, a trusted emergency contact with takeover access, a Duo bypass code from your company, or exporting the vault from a device that is still logged in and starting a new account. Bitwarden says that if none of those work, there is no way for it to recover the account or its data.
1Password: authenticator first, keys second, and a recovery code that does not reset 2FA
Two-factor is turned on at 1Password.com under your name, Manage Account, More Actions, Manage Two-Factor Authentication. You scan a QR code with a separate authenticator app and confirm a six-digit code. During setup 1Password shows a 16-character secret and tells you to keep it somewhere safe; that string can rebuild the authenticator entry on a new phone.
Security keys such as YubiKey or Titan can be added as a second factor if they are FIDO U2F-compatible with the U2F protocol turned on. Having an authenticator app as well is not required, but 1Password recommends one: it is the only way to sign in on a browser that does not support security keys, and the fallback if you lose the key. Windows users may need to give 1Password access to passkeys in Windows Settings.
Once two-factor is on, you need a code on any new device and to reauthorize existing ones; a device that has accepted a code is not asked again unless you sign out, change your email or account password, regenerate your Secret Key, or have the account recovered. If you lose the factor, you cannot sign in on new devices until two-factor is turned off, which you can do from an app that is still signed in or from 1Password.com.
The recovery code works differently from Bitwarden. It is available only on individual and family accounts. Using it, after verifying your email, gives you a new Secret Key and account password with all data intact, but two-factor stays on, so a recovery code alone will not get you past a lost authenticator. It stays valid for reuse, replacing it invalidates the old one, and 1Password warns not to use a newly created code for at least an hour. On family and business accounts, recovery started by a family organizer or administrator does reset two-factor.
What happens if you lose your second factor
| Situation | Bitwarden | 1Password |
|---|---|---|
| You still have another method | Choose Use another two-step login method on the login screen | Sign in with the authenticator app if you lost the key, or the key if you lost the phone |
| You have the recovery code | Code turns off all two-step methods; set them up again | Code resets password and Secret Key but not two-factor |
| Still signed in somewhere | Use the web app to turn off two-step login with your recovery code, or export the vault from any logged-in app | Turn off two-factor from an authorized app or 1Password.com |
| Someone else can help | Enterprise admin account recovery, trusted emergency contact with takeover access, or company Duo bypass code | Family organizer or team admin recovery, which resets two-factor |
| Nothing works | Bitwarden says it cannot recover the account or its data; delete and start over | Without an authorized device or someone who can recover you, you cannot sign in on new devices |
Setup checklist for each vendor
- Bitwarden: in the web app go to Settings, Security, Two-step login, and add a FIDO2 security key (free) as the primary method.
- Bitwarden: add an authenticator app as a second method so a lost key does not lock you out; keep the web vault tab open and test before signing out elsewhere.
- Bitwarden: view the recovery code right away and store it on paper or in a safe place outside Bitwarden; get the new one after any use.
- Bitwarden: if you hold Premium and want two keys plus spares, remember the limit rises from 5 to 10 keys.
- 1Password: turn on two-factor with an authenticator app other than 1Password and save the 16-character secret offline.
- 1Password: add a FIDO U2F-compatible security key and confirm U2F is enabled on it, then test sign-in on a second browser.
- 1Password: on an individual or family account, set up a recovery code, wait at least an hour before you would ever need it, and store it apart from the 16-character secret.
- Both: keep at least one signed-in device, such as a phone, and add an emergency contact or family organizer who can help if everything else fails.
For small teams: enforcing it for everyone
Bitwarden Teams and Enterprise organizations can push Duo two-step login to members. Enterprise adds a Require two-step login policy; members who are not owners or admins and do not comply lose access until they set up a method, and Bitwarden advises not to use the policy if SSO or Duo already covers every member.
In 1Password, an owner or administrator can turn on Duo for the whole organization. Anyone already using built-in two-factor has it replaced by Duo, and Duo then asks each person to approve sign-ins on new devices and once every 30 days or sooner. Duo is a separate service, not part of the 1Password subscription.
Questions before you decide
Can I use a YubiKey with Bitwarden Free?
Yes, as a FIDO2 WebAuthn security key, which is free for all Bitwarden users with up to five keys. The separate YubiKey OTP mode requires Premium, and Premium raises the key limit to ten.
Does the 1Password recovery code turn off two-factor authentication?
No. 1Password says that if two-factor was on, it remains turned on after using a recovery code. You get a new Secret Key and account password, so keep your 16-character authenticator secret as a separate backup.
What does using a Bitwarden recovery code do?
It deactivates all two-step login methods on the account, except Duo enforced by an organization, and Bitwarden generates a new recovery code. Set your methods up again afterward.
Can Bitwarden support turn off my two-step login if I lose everything?
Bitwarden says that if no recovery option works, there is no way for it to recover the account or its data. You would delete the account and create a new one.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Bitwarden: two-step login methods Accessed 30 Oct 2026
- Bitwarden: two-step login via FIDO2 WebAuthn Accessed 30 Oct 2026
- Bitwarden: two-step login via authenticator Accessed 30 Oct 2026
- Bitwarden: two-step login via email Accessed 30 Oct 2026
- Bitwarden: recovery code for two-step login Accessed 30 Oct 2026
- Bitwarden: lost two-step login device Accessed 30 Oct 2026
- Bitwarden: enterprise policies Accessed 30 Oct 2026
- 1Password: use two-factor authentication Accessed 30 Oct 2026
- 1Password: use a security key for two-factor authentication Accessed 30 Oct 2026
- 1Password: recovery codes Accessed 30 Oct 2026
- 1Password: recover accounts Accessed 30 Oct 2026
- 1Password: Duo Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.