Password and second-factor tools: selection and recovery

Storing passwords and generating a second sign-in factor are two different jobs, even if some apps do both. Mixing them without a recovery plan means that losing one phone can cut you off from both your passwords and your second factor. This page helps you match the tool to the job; each layer’s setup is covered in its own guide.

The choice between a local file and a syncing service is in the password manager guide. How to choose a second method and test recovery is in the guide to two-factor authentication. If an account is already lost, go to recovering a compromised account rather than changing every tool at once.

Separate the two jobs first

1. A password manager should create unique passwords and keep them in a vault so the same secret is not reused across sites.
2. A second factor should show that your device or key is present at sign-in, even if the password has leaked.
3. Write down recovery for each one separately: how you reach the vault if the phone is lost, and how you get back into accounts if that same phone held the codes.
4. Treat SMS as the weakest of the common methods, and use a better method first when one is available.

Password managers: local, synced or built into the system

A password manager creates random passwords and keeps them in a vault. There are three common families, and none is best for everyone.

A local file such as KeePassXC stays on your own device. Get the program from keepassxc.org. You control the file, and automatic sync is not the default. You have to decide where to keep a copy of the encrypted file and keep that copy apart from the master password.

A syncing service such as Bitwarden or 1Password moves the vault among your devices. Get the install from that service’s official site. The convenience is high; in return you have to think about how that service is maintained, about the master password, and about two-factor authentication on the vault itself if it is offered. Do not treat sync as a backup: if you lose the master password, the synced copy will not open either.

The manager built into the operating system is simple for someone who stays inside one ecosystem. It is tied to that same Apple, Google or Microsoft account. If you lose that account, the stored passwords are at the mercy of that account’s recovery as well.

1. Pick one manager and move the main passwords — email, banking, stores, social networks — into it, rather than keeping three half-finished managers.
2. Make the vault’s master password long and unique, and remember or write it somewhere separate from the vault itself.
3. Make a recovery copy: put a second copy of the encrypted KeePassXC file somewhere else, or write down the syncing service’s recovery key off the device.
4. Install a browser extension only from that browser’s official store, and do not follow a link inside a message.

Second factors: SMS, authenticator apps, hardware keys and passkeys

An authenticator app such as Aegis or other TOTP apps, a hardware security key and a passkey each resist phishing to a different degree. SMS is the weakest of the common methods, because a number can be moved to another SIM or the message can be read on the same phone.

1. If you want Aegis on Android, get it from getaegis.app or the official store, not from a file in a messenger. On other systems use an official, maintained TOTP app.
2. When an account shows a QR code, store it in the authenticator app and write that service’s backup codes down at the same moment.
3. Buy a hardware security key from a known maker through an official path. Register it on your main accounts and keep a second key or a backup method so losing one key does not lock you out.
4. A passkey on the device or in the password manager resists a fake page better than a password plus SMS. After you create a passkey, still read the account’s recovery path; a domain change or a lost device can stop the key working.
5. If SMS is the only option, use it temporarily and upgrade to an authenticator or a key as soon as one is available.

Do not keep one-time codes only inside the same vault

If the password manager can also store TOTP codes, that is convenient — and it puts everything in one place. Anyone who reaches the vault then has both the password and the code. At higher risk, keep the second factor on a separate device or key.

1. For highly sensitive accounts — the main email, the password manager itself, a bank — keep the code on a tool separate from the vault.
2. Whichever you use, keep a backup of the secrets: an encrypted file, the service’s backup codes, or a second hardware key.
3. Do not leave that backup only on the same phone or in the same synced folder as the vault.
4. Test recovery once: sign in from a second device, or pretend the phone is unavailable, and see that the way back actually works.

Think in line with common 2026 guidance

More recent password guidance usually stresses length and uniqueness, and changing a password after a leak, rather than forcing a change every few months. It treats phishing-resistant second factors as better than SMS. This page is not an official standard; if you work for an organization, that organization’s policy comes first.

1. Move short and reused passwords into the vault first and change them, not passwords that are already unique and long.
2. Do not change a password only because a date on the calendar arrived, unless you have seen a leak or a suspicious sign-in, or workplace policy requires it.
3. Wherever a passkey or a hardware key is available, prefer it to SMS.

What happens when you lose the tool

1. If only the phone is lost and a synced vault is on the computer, you still have the passwords there; a second factor that lived only on that phone may be gone. Backup codes are what help here.
2. If a local KeePassXC file lived only on that device and you had no copy, the passwords went with the device. That is the reason for a separate copy.
3. If the password-manager account is broken into, change the master password from another device, close sessions and re-harden the accounts inside the vault in order of importance.
4. Do not “rebuild” an authenticator app or a recovery file from an unofficial path.

How to move passwords into the vault

The move does not have to cover every account overnight. First move the accounts that, if leaked, open the rest: the main email, the app store itself, and the network that recovery of other accounts is tied to.

1. Let the new manager create a random password for that account, sign in, change the password and store the new value.
2. If the browser still shows old passwords, clear the browser’s save for that site after each move so two conflicting copies do not remain.
3. Delete a password export file from the browser after it has been imported, and do not leave it on the desktop or in a chat; that file is often plain text and highly sensitive.
4. You can move lower-priority accounts gradually, each time you sign into them.

Shared passwords and team accounts

Sending a password in an ordinary message, even to a colleague, leaves that secret in the chat history. If you must share access, use sharing inside the password manager itself or an account with a separate role, not a line of text in a group.

1. When the collaboration ends, close access and change the password.
2. Do not reuse a personal password on a work account.
3. If the organization has an organizational password manager, follow that policy for organizational work and do not mix a personal vault into it.

Lock the vault itself like a vital account

1. Turn on two-factor authentication for a syncing service, and choose a method that will not disappear together with the passwords if that same phone is lost.
2. Close open sessions on old devices from that service’s own panel.
3. Use a recovery email for the vault that you yourself control, and give that email a unique password and a non-SMS second factor. Do not share this recovery email with friends or in a work group.

Common mistakes

• Keeping every password in the browser with no master password and no extra copy.
• Storing one-time codes only inside the same vault that holds the passwords, with no separate copy, while the accounts are high-risk.
• Relying on SMS because “it was already on” and never upgrading.
• Installing a password manager or authenticator from a file in a group.
• Never testing recovery until the day the phone is lost.
• A single hardware key, with no second method, on an account your life depends on.

What to do today

1. Set up a password manager and move your main passwords into it.
2. Add a non-SMS second factor on those same accounts.
3. Test recovery for both layers once.
4. If the risk is higher, keep one-time codes for vital accounts apart from the vault and write backup codes down off the device.
5. Install programs only from that project’s official path: KeePassXC from keepassxc.org, an authenticator from its official site or store. After you install, do a test sign-in on a second device and a complete test recovery this week, in fully calm conditions and without unnecessary rush or pressure.