2FA means signing in needs two different kinds of proof. Almost always that's "something you know" (your password) plus "something you have" (your phone, a key, or your fingerprint).
The kinds of 2FA you'll run into
Type
How it works
Strength
SMS text code
A code is texted to the customer's phone number.
Weakest — phone numbers can be hijacked ("SIM swapping"). Better than nothing.
Authenticator app (TOTP)
An app (or Keeper itself) generates a new 6-digit code every 30 seconds from a shared secret set up once.
Good — not tied to a phone number, works offline.
Push notification
The service's own app sends an "Approve this sign-in?" prompt.
Good, and easy for customers.
Hardware security key
A physical USB/NFC key (like a YubiKey) you tap or insert.
Very strong — nearly impossible to phish remotely.
Passkey / biometric
Covered in the Passwords & Passkeys guide — arguably 2FA and password replacement in one step.
Strongest for everyday use.
Why Keeper is the easy button for TOTP
Keeper can store the same secret an authenticator app would, right on the account's record, and fill the 6-digit code for the customer automatically — no separate app needed.
When the customer turns on 2FA on a website, it shows a QR code and a text "secret key".
Open the matching record in Keeper, add a Two-Factor Code custom field, and paste the secret (or scan the QR from the vault's mobile app).
🖼️ Screenshot not uploaded yet — Adding a Two-Factor Code field in the vault In the Web Vault, edit a record, add a Custom Field → Two-Factor Code, and screenshot the field with a secret pasted in. A trainer can add it at /admin/screenshots.
From then on, KeeperFill shows the live code right next to the password field at sign-in.
🖼️ Screenshot not uploaded yet — KeeperFill showing the current code at sign-in Screenshot KeeperFill's little popover showing the current 6-digit code on a real 2FA screen. A trainer can add it at /admin/screenshots.
Always save the recovery codes the site gives you (usually 8-10 one-time backup codes) into the record's notes — that's the customer's parachute if they lose their phone.
Say this to a customer"Right now, if someone gets your password — from a data breach on some other website, say — that's all they need. Two-factor means they'd also need your phone. And once it's in Keeper, you won't even notice it's there; it just fills in for you."
What can go wrong (and what to do)
Customer loses their phone / the authenticator is gone. Use a recovery code, then turn 2FA off and back on to get a fresh secret. Practice this exact sequence in the Training Track's "cycle" mission.
Codes never match. The device's clock is probably off — TOTP is time-based. Check the date/time is set to automatic.
Customer is locked out after too many attempts. That's a safety feature, not a bug — see the "lock" mission for what that looks like and how an admin clears it.
Simple Technologies · Login Lab — a training sandbox. Nothing here is a real account. · Guides · Training Track