How it works
When 2FA is on, logging in takes two things: your master password, and a 6-digit code from an authenticator app on your phone. The code changes every 30 seconds and is generated on your phone, even without signal.
PasswordPal uses the open TOTP standard (RFC 6238), so it works with Microsoft Authenticator, Google Authenticator, Authy, 1Password, Bitwarden Authenticator and others.
Setting it up takes about a minute
- Install Microsoft Authenticator from the App Store or Google Play (if you don't already have it).
- In PasswordPal, open the account menu → Security, 2FA & passkeys → Set up two-factor authentication.
- In Microsoft Authenticator, tap + → Other account (Google, Facebook, etc.) and scan the QR code. (Can't scan? Choose "enter code manually" and type the setup key shown.)
- Type the 6-digit code the app shows, then save your 10 backup codes somewhere safe.
See the step-by-step guide for screenshots-in-words and troubleshooting.
Built-in protections
- Backup codes: ten single-use codes for when your phone is lost, flat or replaced. You can generate a fresh set any time.
- Replay protection: each code works once, so a code someone sees over your shoulder is useless to them.
- Encrypted at rest: your 2FA secret is stored encrypted on our servers.
- Attempt limits: too many wrong codes and the login has to start again.
- Email alerts whenever 2FA is turned on or off.
Lost your phone?
Log in with your master password and enter one of your backup codes instead of the 6-digit code. Then set up 2FA again on your new phone (which also gives you new backup codes). If you've lost your backup codes too, contact us — we'll verify it's you before removing 2FA from your account.
Prefer not to type codes? Passkeys are an even stronger, faster option — sign in with your fingerprint, face or device PIN.
Questions
Do I have to use Microsoft Authenticator?
No — any TOTP authenticator app works. We mention Microsoft Authenticator because it's popular and free.
The code says it's wrong but I typed it correctly.
Codes depend on the time. Make sure your phone's date and time are set automatically, then try the next code.
Is 2FA required?
It's optional for personal accounts but strongly recommended. Team owners can require it for their members, and administrators must use it.
Does 2FA protect my vault encryption?
Your vault is encrypted by your master password. 2FA protects your account login — together they mean an attacker needs both your password and your phone.