2FA authenticator · TOTP
Encrypted 2FA codes that are not tied to one phone
MGVault generates the same one-time 2FA codes as authenticator apps like Google Authenticator. The difference: your 2FA secrets are backed up end-to-end encrypted, kept in sync between the web vault and the browser extension, and can be shared securely with your team.
- RFC 6238 compliant TOTP
- Codes are generated on your device
- Import from Google Authenticator
What is a 2FA code (TOTP)?
A time-based one-time password (TOTP) is the 6-digit code, usually changing every 30 seconds, that a site asks for in addition to your password. It is computed under the RFC 6238 standard from a secret key shared between you and the site, plus the current time. Even if your password is stolen, someone who cannot produce this code cannot sign in.
All of this rests on the secret key: lose the key and you lose the codes; leak the key and your second factor is gone. That is why where and how 2FA secrets are stored matters as much as where your passwords are kept.
Why keep your 2FA codes in MGVault?
A lost phone is not a lost account
Your 2FA secrets live in your encrypted vault. If your phone is lost or broken, you sign in from another device and keep using your codes.
Codes are generated only on your device
Secrets are encrypted on your device with XChaCha20-Poly1305 and codes are computed in your browser or the extension. Our server sees neither your secrets nor your codes.
Shared 2FA for team accounts
When several people use the same cloud, social media or admin account, keep its 2FA secret in a shared vault, grant access per person, and get a list of accounts to re-enroll when someone leaves.
One-click copy and fill
Copy the live code from your vault or fill it into the sign-in form with the browser extension. The clipboard clears itself after a short time.
Phone-only codes compared with MGVault
An authenticator app on one phone works well for one person and a few accounts. The differences show as your accounts and your team grow.
| Topic | Authenticator on one phone only | MGVault |
|---|---|---|
| If the phone is lost | Without a backup the codes are gone; each account needs its own recovery. | Your encrypted vault is intact; you continue on another device. |
| Backup | Depends on the app and your settings. | End-to-end encrypted; the server cannot read it. |
| Multiple devices | Codes usually live on a single device. | Synced between the web vault and the browser extension. |
| Sharing with a team | The secret has to be passed around by hand. | Per-person access with signed keys. |
| When someone leaves the team | Hard to know who had which code. | The key is rotated and the 2FA accounts to re-enroll are listed. |
How to move from Google Authenticator to MGVault
You do not need to re-enroll every account. It takes four steps:
- 1
In Google Authenticator, choose Transfer accounts → Export accounts and select the accounts to move.
- 2
Take a screenshot or a photo of the export QR codes the app shows.
- 3
In MGVault, open Import → Google Authenticator and upload the images, or paste the otpauth-migration:// link. The images are decoded in your browser.
- 4
Check that the codes work on the sites, then permanently delete the screenshots from your device.
Using a different authenticator? Paste each account’s otpauth:// link or setup key, or scan the QR code the site shows.
Password and 2FA in one vault: an honest assessment
Keeping a password and its 2FA secret in the same vault ties both factors to the security of one vault. Whoever takes over the vault gets both.
MGVault reduces this risk by protecting the vault itself: the master password never leaves the device, sign-in can require a passkey or authenticator app, and the vault locks itself when idle. For your most critical accounts, such as email and banking, you may still prefer a separate hardware key as the second factor; MGVault then becomes a practical, secure home for everything else.
Questions about the 2FA authenticator
Can MGVault replace Google Authenticator?
Yes. MGVault uses the same RFC 6238 TOTP standard as Google Authenticator and similar apps, so it works with every site that supports the standard. It supports different code lengths and periods, and the SHA-1, SHA-256 and SHA-512 algorithms.
How are my 2FA secrets stored on the server?
Only in encrypted form. The 2FA secret is encrypted on your device with XChaCha20-Poly1305 together with the rest of the item and sent as an encrypted blob; the server cannot see the secret or the codes it produces. The TOTP secret that protects your own MGVault sign-in is different: because the server verifies that code, its secret is stored encrypted on the server.
Can I generate codes without an internet connection?
Yes, with the browser extension. It keeps an encrypted copy of your vault on your device and can unlock it and show codes while offline; items cannot be added or edited in that mode. The web vault needs a connection.
Which sites does it work with?
Any site that gives you a QR code or setup key during 2FA enrollment and uses standard TOTP; Google, Microsoft, GitHub and AWS accounts are examples. Codes sent by SMS and proprietary, non-standard code formats are not covered.
Can I share a 2FA account with my team?
Yes. Add the 2FA item to an organization’s shared vault and everyone with access sees the same live code. You grant access per vault and per person. When someone is removed, the vault key is rotated and the 2FA accounts they could see are listed for you to re-enroll.
Get started
Start your vault in under a minute
Free for personal use. Your keys are created on your device — right now, in your browser.