Okay, let me put it less ambiguous: If they login to your password manager in a remote location, from their own device, they can't get to your TOTPs if you sto

Okay, let me put it less ambiguous: If they login to your password manager in a remote location, from their own device, they can't get to your TOTPs if you store them separately in an app on your phone. > TOTP apps like Authy have no authentication. This is just wrong. My Authy is locked with separate pincode+FaceID and has been for years. And in general, if they are in your physical phone (presumably because they know your pincode), they can wreak all sorts of havoc already. They can add themselves as an alternative recovery e-mail to your Apple ID / Google account. Perhaps they can even disable TOTP 2FA via SMS, although I am not to certain of that.