How to share 2FA codes with your team without waiting for one person's phone

Why do SMS codes and one phone break team accounts?

Two-factor authentication was designed for one person with one phone. Shared business accounts, such as a social media profile, a supplier portal or an ads account, break that assumption. The usual workaround is "message Sam and ask for the code", and it fails in predictable ways.

• Availability: the code holder is asleep, on a flight, in a meeting or on holiday.
• Leavers: when the code holder leaves, the account is stuck on their number until someone recovers it.
• Leakage: codes get pasted into group chats where anyone in the thread can see them.
• Weak factor: SMS can be intercepted or redirected through SIM swapping, which is why NIST SP 800-63B treats SMS as a restricted authenticator.

The fix is not to drop 2FA. It is to choose a factor that can be shared deliberately and revoked cleanly.

What is TOTP and why can a team share it?

TOTP stands for time-based one-time password. It is the 6-digit code shown by authenticator apps. When you turn it on, the website generates a random secret key and shows it as a QR code, usually with a text version labelled "setup key" or "can't scan the code?".

Your authenticator combines that secret with the current time and produces a code that changes every 30 seconds. The website does the same calculation and checks that the codes match. Nothing is sent to your phone; the code is computed locally.

That is the key insight for teams: anyone who holds the secret can generate valid codes. If the secret lives in a shared, encrypted vault entry instead of one person's phone, every authorised teammate gets the code on demand.

How do you move a shared account from SMS to TOTP?

1. Sign in to the account with the current owner present.
2. Open the security or two-factor settings and choose authenticator app.
3. When the QR code appears, select the option to show the setup key as text.
4. Paste the key into the shared password manager entry for that account, next to the password.
5. Enter the 6-digit code it generates to confirm setup.
6. Remove the SMS factor if the site allows it, or replace the phone number with one the business controls.
7. Download the backup codes and store them separately (see below).

If the site only shows a QR code, many authenticators and password managers can read the QR image directly. Do not save a screenshot of the QR code in a shared drive; it is the secret in picture form.

Where should the TOTP secret be stored?

Store it somewhere encrypted, access-controlled and auditable. A team password manager meets all three. A spreadsheet, a pinned chat message or a note on a shared computer does not.

Some teams prefer to keep the password and TOTP secret in separate places so that a single compromise does not expose both. That is a fair trade-off for very sensitive accounts. For most shared business logins, keeping them together in a well-protected vault is far safer than the chat-based alternative.

What should you do with backup codes?

Backup codes are single-use codes that let you in when the authenticator is unavailable. They are effectively spare keys, so treat them as more sensitive than the daily code.

• Store them in a separate entry that only account owners can open.
• Do not give contractors or temporary staff access to them.
• Cross off or regenerate codes after use.
• Regenerate the whole set after anyone with access leaves.

What are the security trade-offs of sharing 2FA?

Sharing a TOTP secret is a conscious compromise. The second factor is no longer "something one person has"; it becomes "something the team's vault has". Be honest about what that means.

• Your vault becomes the key target. Protect it with a strong master password and its own sign-in protection.
• Anyone with the secret can keep generating codes, even after you remove their vault access, if they copied the secret. Rotate the secret when people leave.
• It does not replace individual accounts. Where a service supports separate users with roles, use that instead; shared 2FA is for services that only allow one login.
• Phishing still works on TOTP. A fake login page can relay a code in real time. Autofill that only fills on the real site helps, and so does training people to check the address bar.

For accounts that support passkeys or hardware security keys for individual users, those are stronger options. Shared TOTP is the practical middle ground for genuinely shared logins.

Which shared accounts should you move to TOTP first?

You do not need to convert everything in one afternoon. Start with the accounts where a blocked sign-in costs the most or where codes are already being forwarded in chats.

• Money and billing: payment processors, banking portals that allow shared access, domain registrars.
• Public voice: social media profiles and business listings, where a takeover is visible to customers.
• Advertising: ad accounts that spend money automatically.
• Infrastructure: hosting, DNS and email providers that everything else depends on.

Keep a simple list of each account, who owns it, where its secret is stored and when it was last rotated. That list becomes your offboarding checklist.

How do you rotate a shared 2FA secret when someone leaves?

1. Remove the leaver's access to the vault entry.
2. Change the account password.
3. Turn the authenticator off and on again (or choose "change authenticator") to get a new secret.
4. Save the new secret in the shared entry and confirm the code works.
5. Regenerate backup codes and replace the old ones.

How does BobWork Vault handle shared 2FA codes?

BobWork Vault is a free team password manager that stores authenticator (TOTP) secrets in the same entry as the login. After the Chrome extension fills the password, it fills or copies the 6-digit code, so teammates are not hunting for a phone.

You share each entry, or a whole folder, with Owner, Edit, View or Login only access. When someone leaves, a guided offboarding flow removes their access, re-keys the remaining shared items and builds a checklist of passwords to change on each site. Items are encrypted in the browser before they reach the server; see how the encryption works.

If you are moving off SMS codes this week, create a free team vault and add the setup key as you switch each account to an authenticator.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to set up a shared Google account for a team without passing one phone around
• What is zero-knowledge encryption in a password manager?
• How to share passwords with your team
• How BobWork Vault encrypts your passwords

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers