When a site asks for a six-digit code after your password, it is almost always using TOTP, the time-based one-time password standard defined in RFC 6238.
How the code is made
- When you turn on 2FA, the site shows a QR code. It contains a random secret that only you and the site know.
- Your app combines that secret with the current time, counted in 30-second steps, using a hash function (HMAC-SHA-1 by default).
- The result is cut down to six digits. The site does the same calculation and checks that the numbers match.
Because the time step moves on every 30 seconds, a code someone sees over your shoulder is useless a moment later.
What 2FA protects you from
Most account takeovers start with a password that leaked from another site. With 2FA on, that password alone gets an attacker nowhere. It is one of the most effective protections you can switch on.
Where to keep your codes
Zen Passwords keeps the secret inside the item it belongs to, encrypted with the rest of your vault, and shows the live code beside the login. You can add one from a QR code, an image or by typing the setup key.
Keep the backup codes each site gives you when you turn on 2FA. Store them as a secure note, so you can still get in if you lose your phone.
Questions
Do 2FA codes need an internet connection?
No. The code is calculated on your device from the secret and the clock, so it works in airplane mode.
Is it safe to keep 2FA codes in a password manager?
It is a trade-off. It is far safer than having no 2FA at all, and much more convenient. Keeping codes in a separate app protects against someone who learns your master password, so do that for your most important accounts if you prefer.