What a built-in authenticator does
Most sites that offer app-based two-factor authentication show a QR code containing a secret. Any authenticator turns that secret into a six-digit code that changes every 30 seconds. A password manager with a built-in authenticator stores the secret in the login item and fills the code right after the password.
The benefit is speed and fewer lost phones locking you out. The cost is that one vault now holds both factors for that account.
Which plans include it
| Question | Bitwarden | 1Password | NordPass |
|---|---|---|---|
| Plan needed | Storing keys: all accounts. Generating codes: Premium or a paid organization (Families, Teams, Enterprise) | All plans are paid; the help page does not restrict by tier | Premium and Family; not on Free, per the plans page cards, its comparison table and the support article |
| Where it works | Scan a QR code in the browser extension or mobile app; any login item can hold the key | Browser extension, apps for Mac, Windows, iOS, Android and Linux, and 1Password.com | Android and iOS apps, and the extension in Chromium browsers on macOS and Windows and Firefox on Windows |
| How codes fill | Browser extension and iOS 18+ autofill the code; automatic copy to clipboard is on by default | Filled automatically after username and password; optional automatic copy; iOS 18+ field suggestion | Autofilled only if NordPass also filled the username and password; otherwise copy |
| Adding a code | Scan a QR code, type the key, or sync from the Bitwarden Authenticator app | Scan the QR code in the extension or app, or paste the setup string | Edit the login, Add Two-factor Code, then scan or enter manually |
| Vendor caution | Separate Bitwarden Authenticator app also offered | Set device date and time correctly | Do not store the NordPass account code inside NordPass Authenticator |
The security trade-off in plain terms
Two-factor authentication works because an attacker needs two different things. If the password and the code generator sit in the same vault, someone who gets into the vault gets both. For most accounts that is an acceptable risk, because a vault protected by a strong master password and its own second factor is hard to break into, and storing codes there means you actually turn on two-factor everywhere instead of skipping it.
The risk is concentrated in a few accounts: the ones that can reset everything else. NordPass makes the same point about its own login, warning not to store the NordPass code in NordPass Authenticator because you could lock yourself out. Bitwarden goes further for passkeys and will not save a passkey for a Bitwarden account inside Bitwarden.
Rule of thumb: what to keep separate
- The password manager account itself: use a separate authenticator app, a hardware key or a passkey stored outside the vault.
- Your primary email account: it can reset almost every other password.
- Banking, brokerage and anything that moves money.
- Your phone carrier account, which controls SMS recovery.
- Domain registrar or work admin accounts if you have them.
- Everything else, such as shopping, forums, streaming and utilities: storing the code in the vault is a reasonable convenience.
Decision checklist
- Do you already pay for 1Password, Bitwarden Premium or NordPass Premium? Then the vault authenticator costs nothing extra.
- On Bitwarden Free, decide whether $19.80 a year for Premium is worth it or keep a separate free authenticator app.
- Save each site backup codes outside the vault, on paper or in a separate secure place.
- Keep at least one second factor for the vault itself outside the vault.
- When you move a code into the vault, NordPass suggests disabling and re-enabling 2FA on the site so the old authenticator stops being the source.
- Test one login from start to finish before migrating the rest.
Questions before you decide
Does Bitwarden Free generate 2FA codes?
No. Bitwarden says all accounts can store authenticator keys, but generating TOTP codes needs Premium or membership in a paid organization such as Families.
Is it unsafe to keep 2FA codes in my password manager?
It concentrates both factors in one place. That is a reasonable trade for low-risk accounts if the vault has its own strong second factor, but keep email, money and the vault login on a separate authenticator.
Does NordPass Premium include the authenticator?
Yes. The NordPass plans page shows NordPass Authenticator on Premium and Family and not on Free, and its Premium vs Free support article lists Authenticator among Premium features.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Bitwarden: pricing Accessed 30 Oct 2026
- Bitwarden: integrated authenticator Accessed 30 Oct 2026
- Bitwarden: storing passkeys Accessed 30 Oct 2026
- 1Password: use 1Password as an authenticator for sites with two-factor authentication Accessed 30 Oct 2026
- 1Password: password manager pricing Accessed 30 Oct 2026
- NordPass: how to use NordPass Authenticator Accessed 30 Oct 2026
- NordPass: Premium vs Free version of NordPass Accessed 30 Oct 2026
- NordPass: plans Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.