How to Share 2FA Codes With Your Team SecurelyGuide
Four ways teams share two-factor codes, what each one costs, and how to give people the codes they need without handing out the secret behind them.
Blog
Two-factor authentication, for teams
How teams share two-factor authentication codes without passing the secret around: practical guides, tool-by-tool walkthroughs and answers to the questions that come up.
Two-factor authentication was designed for one person with one phone. Teams still have to run shared accounts on it. These are the questions that come out of that gap, answered as plainly as we can.
Sharing codes with a team
Getting a code to the people who need it, without handing out the secret behind it.
Can Multiple People Use the Same TOTP?
Yes, technically: several devices holding one secret produce the same code. Here is what actually happens when two people use it, and what it costs you.
How to Give Employees Access to 2FA Without Giving Them the Secret
How to design 2FA access for staff: what to grant per account and per role, what enrolment looks like, and how to handle joiners, movers and leavers.
Best Ways to Manage 2FA for Shared Accounts
Five ways to run two-factor authentication on a shared account, compared on setup effort, cost, remote work and offboarding.
How to Share TOTP Codes Without Sharing the Secret
The practical ways to give teammates a working TOTP code while the secret stays in one place, and what each approach means for revoking access later.
Authenticator apps
What Google Authenticator, Microsoft Authenticator and their QR codes can and cannot do for a team.
How to Share Google Authenticator Codes With a TeamGuide
Google Authenticator has no sharing feature and no notion of a team. The three options that actually work, and how to move an account off one phone.
Is It Safe to Share a 2FA QR Code?
No, and the useful part is why: who ends up seeing a shared QR code, what they can do with it, and how to judge whether an exposure warrants a reset.
Can You Share a Google Authenticator QR Code?
Yes, and it works: the QR code is the secret. Here is exactly what the image contains, what the second phone can do, and what the provider records.
How to Share Microsoft Authenticator Codes With a Team
Microsoft Authenticator does two different jobs: a push approval cannot be shared at all, a six-digit code can, without handing out the secret.
Tool by tool
Stripe, AWS, social accounts: how 2FA actually gets shared on the tools teams live in.
How to Manage 2FA for Shared Social Media Accounts
Most social platforms let people post without ever holding the password. What delegation exists where, and the recovery plan these accounts need.
How to Manage 2FA for a Shared AWS Account
Nobody should share an AWS login, and the root user accepts several MFA devices instead of one copied secret. What that leaves, and how to run it.
How to Manage 2FA for a Shared Stripe Account
Stripe has team members, roles and restricted API keys, so most shared Stripe logins are unnecessary. What is genuinely left, and how to run 2FA on it.
Agencies and small teams
Practices that hold up for an agency running client accounts, or a team spread across time zones.
How Agencies Can Manage 2FA for Client AccountsGuide
Client-owned accounts, forty of them, and staff who rotate. How to ask for proper access, keep clients apart, and hand everything back at the end.
How TOTP works
The mechanics behind the six digits, and what follows from them.
The Complete Guide to TOTP for TeamsGuide
How time-based one-time passwords work, which properties of the algorithm cause every shared-account problem, and what a team needs to run TOTP.
How TOTP Secrets Work (And Why You Shouldn't Share Them)
What a TOTP secret is as an object, the places copies of it quietly accumulate, and the exact order to reset an account whose secret has already been shared.
Two-Factor Authentication: Definition and How It Works
What two-factor authentication is, how it protects an account, which methods exist, and why not every form of 2FA offers the same protection.