NordPass has launched NordPass Authenticator for personal accounts, adding built-in support for time-based one-time passwords (TOTP) inside its password manager. The company is positioning the feature as a way to reduce reliance on separate authenticator apps, aiming to remove common points of friction around two-factor authentication, such as switching phones, losing access to an authenticator device, or juggling multiple security tools.
NordPass describes the new capability as a vault-protected method of storing and generating TOTP codes alongside passwords and other saved items. A key element of its messaging is that access to the codes can be gated behind biometric checks. In practice, NordPass is pitching a model in which users authenticate with a master password, use a trusted device running NordPass, and then rely on biometric authentication to access sensitive vault content, including one-time codes.
The company also frames the feature as a way to limit exposure if a device is stolen or left unattended. NordPass points to vault controls such as autolock settings, and says biometric gating helps ensure that even if someone gains access to the device, they still cannot retrieve the TOTP codes without passing the user’s biometric verification step.
NordPass states that items stored in the vault are protected using XChaCha20 encryption under a zero-knowledge architecture, and that the authenticator feature inherits those same protections. While TOTP inside a password manager does not change the underlying security model of TOTP itself, NordPass is clearly leaning into a usability argument: keeping passwords and 2FA codes in one place can reduce lockout risk and simplify account recovery during device migrations.
NordPass says the feature is available to Premium and Family users across the browser extension and iOS and Android apps. Setup is described as adding a two-factor code to an existing password item, enabling biometrics if prompted, and completing an email verification step. Users can also enable the authenticator through browser extension settings and follow the same biometric and email verification steps.
The rollout is also aimed at shared account management. NordPass suggests that if a credential is shared using its sharing features, the recipient can access the one-time codes on their own device using their own biometric authentication, potentially reducing the need for real-time code handoffs between family members.
Sources: NordPass
—
By the ID Tech Editorial Team
