Two-factor authentication plays two roles in Password Depot: first, Password Depot can itself act as an authenticator and generate TOTP codes for your web accounts; second, it can protect access to your own passwords with a second factor. This article explains both – plus two behaviors that frequently cause confusion.
Password Depot as an authenticator (TOTP per entry)
Select the entry and open Properties → Additional tab.
Under 2FA Secret, enter the secret key provided by the respective service.
Password Depot continuously generates TOTP codes from it. The current code is displayed in the details area of the entry together with its remaining validity in seconds; you can copy it via the TOTP button in the top bar or via hotkey: Ctrl+Alt+O (find and insert TOTP – finds the entry matching the active website/application) or Ctrl+Shift+Alt+O (insert selected TOTP).
As of version 19, the TOTP generation settings button provides advanced options: Digits (4–16), Period (seconds) (10–300), and Algorithm (SHA1, SHA256, SHA512) – for services that deviate from the usual default values.
2FA for access to your passwords
Single-user (local database): There is no TOTP prompt here. The second factor is the protection method Master password and key file – selectable when creating the database or later via Database → Properties → General tab → Change.
Enterprise Server: The administrator sets the 2FA operation mode per user: Default, Deactivated, TOTP, Email, or FIDO2 (Server Manager → Users → user properties → Account tab → Two-Factor Authentication). When you first log in with TOTP, scan the displayed QR code with an authenticator app (or enter the secret key manually) and confirm with the 6-digit code; from then on, a code is requested at every login. With Trust this computer, the prompt is skipped on that device for 30 days by default (duration adjustable in the Server Manager; the feature can be disabled). Keep your system clock synchronized – TOTP codes are time-based and are rejected if the clock deviates. If a device is lost, the administrator can reset the user's operation mode and thereby renew the 2FA setup.
Two clarifications (intended behavior)
Logging in to the Server Manager directly on the server (localhost): No 2FA code is requested here. This is intentional and serves as a recovery path so that administrators cannot permanently lock themselves out. It requires access to the server machine itself.
Offline mode: 2FA protects the login to the Enterprise Server. In offline mode you do not log in to the server; instead, you open the local copy of the database with your login password – which is why no code prompt appears.
Note: FIDO2/WebAuthn is currently supported as a 2FA method in the Windows client only.
Related topics: