Bitwarden Authenticator MFA/2FA Sync

[ados8]

I think this feature has been out for a little while now and I've not been able to configure it, is it not supported?
According to official documentation the setting should be in settings -> account security -> allow authenticator syncing.
However there's no such option which makes me think it only works with native Bitwarden.

Edit: seems it's only been out a month officially from 2025.6.0.

[stefan0xC]

https://bitwarden.com/help/totp-sync/#set-up-sync is indeed only mentioning the Bitwarden Password Manager.

[MrOwen]

Somehow, some way, I was able to enable this on my iPhone (bw app and auth app both on 2025.7.0) and the auth app now shows all my bw totp codes after toggling the option for authenticator syncing in the bw app. Option does not show up on my wife's iPhone, exact same versions of the apps. I am on latest vaultwarden (1.34.3), with following feature flags enabled:

inline-menu-positioning-improvements,inline-menu-totp,ssh-agent,ssh-key-vault-item,export-attachments,anon-addy-self-host-alias,simple-login-self-host-alias

If there's any diagnostics or anything the like I can help get, happy to provide.
On Android, I'm still out of luck. No sync option appears.

[ados8]

@MrOwen has it been working ok?

[DoctorXOR]

The option appeared for me pretty recently (1-2 weeks?) after a recent update to the iOS Bitwarden application. Like MrOwen said, the sync works and I can see all my TOTP codes. However, there are some corrupt titles and usernames which make it hard to consider using. And slightly more concerning, information not found in my Vaultwarden entries seems to be populating in Authenticator.

Assume the expected title for all examples below is "Github" and the expected username is [email protected]. For one particular deviation, let's also pretend my full name is "Jonathan Michael".

Expected values in Authenticator:
Github | [email protected]

Error 1 - Unknown source of text as the username
Github | Authenticator 2

Error 2 - Part of last name as the username
Github | ichael

Error 3 - Unknown source of title (somewhere on the website?), and no username
Github - Online Service | [empty]

Error 4 - Username as the title, and no username (notice that I can't easily tell which vault entry this maps to)
[email protected] | [empty]

Error 5 - URL as the title, and no username
www.github.com | [empty]

Error 6 - Username truncated from the left
Github | [email protected]

Error 7 - Spaces in front of the username
Github | username

For examples 1-3, I confirmed that the unexpected text is not anywhere in the source vault entry. Seems like one app or the other would have to request that info from individual websites. I don't see any reason the sync should be getting any information from the web. The appearance of my name in example 2 is enough to make me turn this option off for now.

I considered posting this on a recently opened thread for Authenticator ( bitwarden/ios#1736 ), but since I am running Vaultwarden I thought it best to discuss here until I have a guarantee that Authenticator is to blame. Should this be a bug report?

[Gerardv514]

@DoctorXOR i just checked on my end and you're right I see the same. Turning sync off.

[ados8]

That's a shame it's so bugged.
That said, forcing with flags when it's not yet tested by Vaultwarden team could cause issues.
Hopefully this can be supported in future releases.

[ados8]

New update must have happened for my Android phone as it seems to show I can enable it. Will test this weekend with dummy account as people have reported corrupt sync objects.

[ados8]

I did some short testing and no issues, but sadly it doesn't function as I hoped. Was hoping it had the option to sync codes but have them not display in the vault. I'm against having everything in a single exploit chest and so I keep MFA separate, problem is you need backups. I have a semi automated system but was looking for a clean sync option, sadly this isn't it.

[DoctorXOR]

I don't really understand what you're going for. How would the codes be in the vault as a backup, but not be visible to someone that gains access? If you just want the secret strings backed up, you can always export them from Authenticator and put that file somewhere secure (such as the vault) instead of synchronizing.

Have you tried enabling master password reprompt on sensitive items? If you do that, the TOTP codes are not visible in the vault until the item is selected and the master password is entered. All codes still show up in the Authenticator with no extra access requirements. To that end, you could also create MPR items separately from primary logins, although if you manually go through your vault a lot you would need a good naming scheme.

[ados8]

Most people likely want it the way it is, codes in the vault, convenience generally trumps security.
It's fine the way it works but I was hoping it had the option to have replication between physical devices only.

What I have is a primary phone with MFA codes and a backup MFA phone replicated through manual backup and restore.
If something happens to the primary phone there's another that can be used without having to go to backups or one time use codes.
I was hoping there was an option for the vault to sync between devices but not retain the data.
It would likely be difficult to have them sync bidirectional without the vault being the arbiter (keeping data) so it could just sync one way.
Primary device -> secondary device, the latter is always accepting all changes and avoiding conflicts (read only).

My use case is unique, but in my opinion, having the MFA codes in a password manager is a risk I won't accept.
Your going against the fundamental purpose of MFA, a separate entity/device (physical) that adds a high layer of security.
By putting everything on a cloud device your making it effectively single factor.
First it was MFA and now passkeys, just put them all in one place and hope the single door to everything holds.
All it took was 1 password manager to do it and they others copied because humans generally desire convenience.
I'm absolutely not against having options, more the better, I'm just happy trading convenience for more security.

[DoctorXOR]

Edit: I understand username parsing now. Condensed ramblings and speculations.

Good news! (@Gerardv514) I started examining my authenticator secrets and figured out the issue. Authenticator URI parsing isn't very robust and assumes that the Issuer's name will be duplicated in the URI label. The sync feature is then subject to site-specific formatting as well as which method you use to add a TOTP entry to your vault (QR reader vs manual entry).

To sync your vault titles and usernames, trim authenticator keys to only contain the characters after "secret=" up to the next ampersand "&".

You can also customize the appearance in the Authenticator from the vault using this format, where TITLE must be duplicated:
otpauth://totp/TITLE:USERNAME?issuer=TITLE&secret=###

When scanning a TOTP QR code, you are actually reading a full URI similar to the one just described. Bitwarden and its Authenticator have to parse out the secret and other information as needed, and they don't seem to do it well.

The Authenticator URI expects one of two formats. Extra parameters and parameter ordering are ignored.

1. Contains "issuer" - otpauth://totp/TITLE:USERNAME?issuer=TITLE&secret=###
2. Does not contain "issuer" - otpauth://totp/TITLE?secret=###

For example, the key for Error 2 in my previous comment looked like this:
otpauth://totp/jonathanmichael?secret=###&digits=6&issuer=Facebook
The parser expected the URI to start with otpauth://totp/Facebook:jonathan... so it dropped length(Facebook) + 1 = 9 characters. Hence the resulting username of "ichael". I was spooked because my name wasn't anywhere else in the vault entry, but it turns out [Facebook] had put it in the authenticator URI.

To avoid the issue, copy the secret manually instead of scanning QR codes. Otherwise you may have to edit manually anyway.

[Gerardv514]

For the viewing discrepancies, that is a client side issue and I'd suggest to reference bitwarden/ios#1736 (comment) where Katherine has acknowledged issues within spec for this.