8PWDTwo-factor codes, kept with the password, generated on your device
A one-time code is only as safe as the secret behind it. 8PWD keeps that secret in the same encrypted vault as the password, offline, and fills the code for you when you sign in.
How a six-digit code is made
When you turn on two-factor authentication, the website hands you a secret — usually as a QR code. From then on your device combines that secret with the current time and gets a six-digit number that changes every 30 seconds. Nothing is sent anywhere; any app that holds the secret can compute the code. The only real question is where the secret lives.
Where 8PWD keeps it
Inside the vault, next to the password, encrypted the same way (AES‑256‑GCM with a key that never leaves your device). There is no account to log in to and no server that could be asked for it. The encryption page explains the design in plain language.
Filling the code
Since version 2.0 the current code is offered through the system AutoFill flow when a site asks for it, the same way the password is. The Codes tab shows every code with its countdown for the apps that don't support AutoFill, and a tap copies it.
Moving from Google Authenticator or another app
The cleanest way is to scan the QR code again from each service's security settings — the old app keeps working until you remove the account from it. Some apps can export; the import guide covers both routes. Sign in once with the new code before you delete anything.
Backups and new phones
Two-factor secrets are included in every .8pwd export and in the scheduled local backups. Without a backup, a lost phone means lost codes — that is true of every offline authenticator, and it is why 8PWD reminds you after 30 days without an export. Keep the recovery codes each service gives you, too.
Is it wise to keep the password and the code in one app?
The second factor exists mostly to protect you when a password leaks somewhere else — the common case — and it does that whether the code lives in a separate app or in the same vault. What you give up is separation between devices: someone who can open your vault gets both. If that worries you for a few accounts, use a hardware key for those and 8PWD for the rest.
Download on the App Store
Free for ten passwords, every feature included. One purchase for iPhone, iPad and Mac.
