Authenticator app vs password manager: do you need both?

People often ask whether a password manager and an authenticator app do the same job. They don't — they solve two different halves of the same problem, and together they cover both.

What each one does

• A password manager stores long, unique passwords so you don't have to remember them. It fixes weak and reused passwords.
• An authenticator app generates a rotating TOTP code that proves you hold your device. It fixes stolen passwords.

A password is something you know. The authenticator code is something you have. Real security comes from combining the two.

"But my password manager can store 2FA codes too"

Many password managers can now hold TOTP secrets as well. That's convenient, and far better than no 2FA. But it puts both factors behind a single login: if your password vault is breached, both factors fall at once.

Keeping your authenticator on a separate app — ideally a separate device — means the two factors stay genuinely independent. That's the whole point of 2FA.

A simple, strong setup

1. Use a password manager for unique passwords everywhere.
2. Use a dedicated authenticator app for your second factor.
3. Save your backup codes somewhere safe.
4. Turn 2FA on for your email first, then your bank, crypto, and social accounts.

Browse setup guides for hundreds of services →