Passwords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible. My master passw

Passwords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible. My master password has hundreds of bits of entropy and only leaves my brain to enter it. Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.