Store a site's TOTP in Bitwarden with a recovery plan

Bitwarden can keep a site's time-based one-time-password secret beside its login and generate rotating codes. That makes routine sign-in easier, but it places the password and code seed behind the same vault access. For an especially sensitive account, a separate authenticator or hardware security key may give a stronger independent barrier. The service's recovery codes matter either way.

Before you start​

Start with the site's own two-step-verification setup, not a QR code from an email. Check whether your Bitwarden plan can generate integrated TOTP codes; the vendor distinguishes storing a secret from generating codes in some plan tiers.

Do it step by step​

1. Sign in to the service through its official address and begin adding an authenticator method. Keep the existing second factor active until the new method is confirmed.
2. In the corresponding Bitwarden login item, add the TOTP seed using the official QR code or manual secret. Ensure you are editing the correct account, especially when you have work and personal logins on one domain.
3. Generate one code from Bitwarden and enter it into the service's verification screen. Complete the setup only after the service confirms the method is active.
4. Download or copy the service's one-time recovery codes, store them securely outside the same single device and mark them as sensitive. A recovery code is often the only practical route when the vault or phone is unavailable.
5. Sign out and perform a normal login test, then verify the code shown in the vault actually works. If you have a second device, check that the secret syncs only where you intended.
6. For the highest-risk accounts, revisit whether the integrated approach matches your threat model. Consider a separate authenticator or security key and remove superseded methods from the service after successful tests.

Check the result​

The service should list the intended authenticator method, a code from the vault should work, and independent recovery codes should be available. Keep a record of which accounts use integrated codes versus external factors.

If something goes wrong​

If a code fails, check device time, account selection and whether the setup QR was replaced during retries. Do not disable an older working factor until the new one is verified. Use the service's official recovery path if both fail.

Know the limit​

TOTP resists password-only theft but not a vault compromise that exposes both password and seed. It also cannot protect against a real-time phishing page that immediately relays a code; passkeys and security keys may provide stronger origin binding. Bitwarden integrated authenticator