> Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. What are you talking a

> Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. What are you talking about? The whole point of TOTP is if the attacker compromises your password, they still can't log in because they don't have the TOTP code.