Right-click on any entry > TOTP > Set up TOTP. A QR code appears > Click the link 'Can't scan QR code'? (3) You will get a menu Authentication app > Start > Enter password. (2) From the left menu > More > Settings and privacy > Security and account access > Security > Two-factor authentication > Two-factor authentication > Check authentication app. I generated those somewhere else and then edited the screenshots below. Just so you know, the secret key, QR code, and backup codes below are not taken directly from a real Twitter account. Other online accounts like Facebook or Youtube account are similar to this example. If the GIF image is not clear, click on it to enlarge.Ĭlick to expand.In this tutorial, I use Twitter as an example. Watch the animated GIFs below for demonstrations. If the password shows excellent on the KeepassXC strength meter, it will pass other password strength testing sites. The KeepassXC password generator/strength meter is the best so far when compared to other password strength meters I've found on search engines. Use the KeepassXC password generator to generate and measure the strength of your password.

A strong password must contain at least 20 characters with random characters. Use strong, randomly generated passwords for your online accounts. Watch this tutorial on Password Bits on how to get started with Bitwarden. If you don't have the time to backup your passwords, you can use an online password manager like Bitwarden or Lastpass. The database is stored locally on your PC, so you must back it up into a USB drive now and then. If your house gets burned, you will lose your passwords, unless you backup the database somewhere else. It comes with a TOTP function, password generator, password strength meter function, the ability to assign a specific icon for any type of password.Ĭons of using KeepassXC as password manager: It is safe as long as you keep the KDBX database offline. You can set an easy-to-memorize password as your database master password. Pros of using KeepassXC as password manager: Requests expire and are purged from the database every 15 minutes if they aren't approved or denied.Read on the official website here for details: ª - Auth-request public and private keys are uniquely generated for each passwordless login request and only exist for as long as the request does. The initiating client then uses the access code and fulfilled authentication request to authenticate the user with the Bitwarden Identity service. The initiating client then locally decrypts the master key and master password hash using the auth-request private key. The initiating client GETs the encrypted master key and encrypted master password hash. The approving client then PUTs the encrypted master key and encrypted master password hash to the Authentication Request record and marks the request fulfilled. When the request is approved, the approving client encrypts the account's master key and master password hash using the auth-request public key enclosed in the request.

Registered devices, meaning mobile or desktop apps that are logged in and have a device-specific GUID stored in the Bitwarden database, are provided the request.

The initiating client POSTs a request, which includes the account email address, a unique auth-request public keyª, and an access code, to an Authentication Request table in the Bitwarden database. When logging in with a device is initiated:

Bitwarden authenticator totp