The current TOTP (Time-based One-Time Password) autofill functionality is an extremely valuable premium feature, often being the deciding factor for an upgrade (it was for me!). It significantly streamlines the 2FA login process.
However, when a user has multiple separate login items (and their corresponding TOTP seeds) saved for the same root domain, the current matching logic results in an ambiguous dropdown list when attempting to autofill the 2FA code.
The Problem: If a user has two items, for example:
sso.domain.com (with TOTP)
something.domain.com (with TOTP)
…and both match the current login page (i.e., domain.com), the autofill suggestion dropdown below the 2FA input field lists both available TOTP codes, but it provides no label to distinguish which item each code belongs to. The user must guess or manually check which is the correct one for the current login flow, defeating the purpose of the one-click autofill.
The Requested Enhancement (The Feature): We request that the TOTP autofill suggestion dropdown list be enhanced to display the associated Bitwarden Item Name (or a relevant identifier like the sub-domain/URI) alongside the prompt to use the code.
Current (Ambiguous) Display:
Tap to fill code
Tap to fill code
Requested (Clear) Display:
Tap to fill code for 'sso.domain.com'
Tap to fill code for 'something.domain.com'
This small addition would drastically improve the user experience and maintain the efficiency of the premium TOTP feature, especially for users who manage multiple, distinct accounts on subdomains of a single corporate or institutional root domain.
Eight hours ago, @southerndoc described a similar issue and proposed a solution: If you provide a more specific domain or change the Match Detection Options, only one TOTP should be displayed.
And I would agree with @marlin: If you would e.g. set up both domains with match detection “Host”, then you would see only one TOTP suggestion on both domains.
When using Bitwarden’s OTP autofill feature, the popup list only displays the available 2FA codes (TOTP), with only the email adress but without showing the corresponding account titles or names. This makes it difficult to identify which code belongs to which account, especially when:
Multiple accounts share the same base domain
Different services use similar URLs or subdomains.
Current Behavior
The OTP suggestion dropdown displays only the verification codes and username, forcing users to guess the correct one is dedicated to the current page/service when the same username is used multiple times on multiple services of the same domain.
