On Easter Sunday, my wife and I were casually talking about password managers.
She told me she had discovered, and really liked, that you can now store not only passwords in a password manager, but also 2FA codes and even passkeys.
And honestly, I get it.
It is incredibly convenient to have everything you need for login in one place:
passwords, TOTP secrets, passkeys, autofill, sync across devices.
It makes life easier.
It reduces friction.
And it solves real problems.
She had run into exactly the opposite problem before: after changing phones, she could not properly move one 2FA account stored in Microsoft Authenticator. She ended up keeping her old phone around for months just so she could still access that account.
That is obviously not a great security or usability story either.
But the conversation got me thinking about the tradeoff.
If your password, your second factor, and maybe even your passkeys all live in the same vault, then your account security ultimately depends on that one vault staying secure.
In many cases, that means: one password.
Yes, the account itself may still be protected with 2FA.
But from the user’s perspective, the attack surface has changed.
If an attacker compromises the password manager, they may get everything needed for login at once.
That is very different from a setup where:
the password is stored in a password manager
the second factor is kept separately in another app or on another device
That kind of separation is less convenient, but it also reduces concentration of risk.
So is it still 2FA if both factors are stored in the same place?
Technically, yes.
Practically, it is worth thinking twice.
The safest option is often a hardware security key, because it is logically and physically separate.
But even that comes with a cost: the most secure factor is useless when it locks out the legitimate user because they do not have it with them when they need it.
Security is rarely about absolutes.
It is usually about balancing risk, convenience, and recoverability.
For individuals and companies alike, this is the real question:
How many eggs do you want in one basket?
Convenience is valuable.
But concentration of risk is real.
Curious how others think about this:
Do you store passwords, TOTP, and passkeys all in one place?
Or do you deliberately keep them separate?
