Passkeys and 2FA codes in your password manager

What passkeys and 2FA codes are, which of the managers listed here store them and on which plans, and why your most important codes may belong in a separate app.

Key points

A passkey replaces a password with a key pair: the secret part stays with you, and the website gets only the public part. It works only on the website it was made for.
A 2FA code is a six-digit number that changes every 30 seconds. It is a second factor next to your password.
1Password, Bitwarden, and Proton Pass store passkeys on every plan. 2FA codes need a paid plan at Bitwarden and Proton Pass.

Passkeys

A passkey is a sign-in without a password. Your device creates two keys for each website: a secret one that stays in your password manager or on your device, and a public one that the website stores. When you sign in, your device proves that it holds the secret key, without sending it.

Because a passkey belongs to one website, a fake copy of that website cannot use it. That makes passkeys resistant to phishing.

2FA codes

Many websites offer two-factor sign-in with an authenticator app: you scan a QR code once, and the app then shows a six-digit code that changes every 30 seconds. Some password managers can create these codes themselves and fill them in after the password.

What the managers listed here offer

	Passkeys	2FA codes
1Password	yes, saved and used in the browser	yes, stored and filled in automatically
Bitwarden	yes, on all plans, in the browser extension and the apps for iOS 17+, Android 14+, Windows, and macOS	storing the keys on all plans, creating the codes with Premium or a paid family or business plan
Proton Pass	yes, on all plans	paid plans only
Keeper	not checked	not checked

The table shows what the makers state on their own pages on November 12, 2026.

Everything in one app?

Keeping passwords and 2FA codes in the same manager is convenient. But the second factor is meant to protect you if your password is stolen. If both sit in one vault, anyone who gets into the vault has both.

A middle way: keep the 2FA codes for most accounts in the password manager, and the codes for your most important accounts in a separate authenticator app. These are your email, which can reset all other accounts, and the password manager itself. Germany’s Federal Office for Information Security (BSI) recommends a second factor especially for email accounts.

What you can do

Create a passkey wherever a website offers one, and save it in your password manager, so that it works on all your devices.
Turn on 2FA codes for every account that offers them.
Keep the codes for your email and your password manager in a separate authenticator app.
Save the backup codes that websites give you when you turn on two-factor sign-in, in a safe place outside the vault.

Next step

The guide Emergency access and family sharing shows how someone you trust can reach your vault if you cannot.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.