I understand the point of Bitwarden is to only have 1 password for everything but the point of a TOTP in theory is to require a second piece of information.
I think Bitwarden should have the option to allow users to protect TOTP codes with a second, separate, master password so it can effectively function as an independent TOTP manager
Furthermore: The TOTP is the second factor which is protected by the password you use for your Bitwarden account. And in case that this will make you feel better: Bitwarden is about to introduce the “Master password reprompt”. For details on this see here:
Yep I do agree in a way - at least regarding the added security of 2FA.
I do just personally really like the idea of having everything in one place, which is my reason to suggest this kind of “midway solution”
The “Master password reprompt” is different from a second, different master password that the OP was asking.
If it’s just reprompting the same master password again, then the TOTP is no longer the second factor.
I would like to have this feature too, so that I don’t need to create two Bitwarden accounts (one for 1st factor passwords, one for 2nd factor TOTP tokens). I know I need to remember two master passwords anyway, but at least I don’t need to register another email address just to create the 2nd Bitwarden account and pay twice.
I wouldn’t place my 2fa into bitwarden without this feature. Use of 2fa inside of bitwarden should be protected by a separate password – and bitwarden should encourage its use from a different device. In other words, when on your PC and trying to log into a website, you should use your bitwarden browser extension to fill in the password, then use the bitwarden on your phone to get the TOTP code! That way, if there is a keylogger on your PC, the worst they can do is get into your bitwarden password vault, but not the 2fa. (yes this requires some discipline on the user’s part, but bitwarden could strongly suggest this method within its interface somehow. At least provide a warning of some kind, because users, including myself never think of these things!)
Sidenote: I changed the title of this Feature Request from “Separate Password for 2FA (Verification Codes/TOTP/Authenticator Keys)” to “Separate password for access to the integrated authenticator (2FA TOTP codes / Authenticator Keys)”.
I have merged two related threads (“Separate password for access to the integrated authenticator” and “TOTP - protect with second master password”).
Furthermore, the topic title has now been changed to “Unlock the integrated TOTP authenticator separately from the password manager” in recognition of the fact that some users may prefer other unlock methods than entering a second password, and the fact users may have different preferences for how often the authenticator unlocking mut be performed (hence, it is likely that this feature will need to include configurable timeout settings for the authenticator locking).