Two-factor authentication (2FA) asks for something you know plus something you have. SMS codes are common and better than passwords alone, but app-based TOTP (time-based one-time passwords) is usually a stronger default when a site offers both. Here is a clear comparison and how AzAd Vault stores TOTP.
How SMS 2FA works — and where it struggles
After password entry, the site texts a short code to your phone number. Convenience is high; coverage is wide. Weaknesses include SIM-swap social engineering, SMS interception on hostile networks, and delays when traveling. Phone number changes can lock you out if recovery is poorly designed.
SMS still beats no second factor. If a site only offers SMS, enable it — then watch for TOTP or passkey upgrades later. Do not treat SMS as equivalent to authenticator apps or hardware keys.
How TOTP works
TOTP uses a shared secret (often shown as a QR code) and the current time to produce six-digit codes that rotate every 30 seconds. The secret lives in an authenticator app or password manager. No cellular network is required to generate codes once enrolled.
Protect the secret like a password. Screenshotting QR codes into an unencrypted gallery is risky. Prefer importing into an encrypted vault. AzAd Vault includes TOTP on Free (up to 10 codes) and unlimited TOTP on Premium, with Google Authenticator migration support on supported platforms.
Why storing TOTP next to passwords helps
Separate authenticator apps are fine, but a zero-knowledge password manager that also holds TOTP reduces juggling — especially when you restore a device. AzAd Vault encrypts items on device; optional Drive sync carries ciphertext. You still need the master password after a wipe.
Free limits are explicit: 10 TOTP entries. If you need more, Premium via Google Play removes the cap along with item and label limits. Family plans share seats, not vaults — each person keeps private TOTP secrets.
Choosing for each account
Prefer passkeys where available, then TOTP, then SMS, then email codes. Keep printed or encrypted backup codes for critical accounts. After enrollment, delete temporary QR images. Periodically confirm codes still work after imports — see Android 1.0.36 notes on Authenticator QR import fixes in the changelog.
For related reading: passkeys explained, are password managers safe, and AzAd Vault security. Soft next step: store new TOTP secrets in the vault as you rotate important logins this month.
Enrollment hygiene
When a site shows a QR code, enroll immediately in AzAd Vault or another encrypted authenticator, then confirm a code works before closing the dialog. Save backup codes in a vault note. Avoid leaving QR screenshots in cloud photo albums without encryption.
If you migrate from Google Authenticator, use the supported migration flow rather than re-scanning dozens of sites manually. After migration, keep the old authenticator until you verify critical accounts — then remove duplicates to avoid confusion.
Clock skew and travel
TOTP needs roughly correct device time. If codes suddenly fail on one phone, check automatic time settings before resetting every account. SMS may still work abroad with roaming, but TOTP works offline in airplane mode once secrets are stored — a quiet advantage for travel days.
Layering with passkeys and passwords
Ideal stack for a high-value account: unique password in the vault, TOTP or passkey as second factor, backup codes stored encrypted, and recovery email secured with its own TOTP. SMS can remain as a last resort only if the site forces it. Remove old phone numbers from account profiles when you change SIMs.
AzAd Vault Free’s 10 TOTP slots push you to prioritize; Premium removes the cap when your life no longer fits. That explicit limit is intentional clarity, not a hidden throttle on encryption quality.
Hardware keys still have a place
Security keys (USB/NFC) remain excellent for a few crown-jewel accounts. TOTP covers breadth; hardware keys cover depth. AzAd Vault focuses on software TOTP and Chrome passkeys rather than replacing physical keys. Use both if your threat model includes targeted attacks.
For most households, replacing SMS with TOTP on email, Apple/Google/Microsoft accounts, and banking — where allowed — is the highest-ROI weekend project you can do with a password manager.
Backup codes storage pattern
Create a vault item named after the site with a secure note holding backup codes. Lock that item behind the same master password. Print one sealed copy only if your threat model includes total device loss without cloud ciphertext.
Destroy outdated printed codes when you rotate. Cluttered envelopes of obsolete codes create false confidence.
AzAd Vault keeps the same zero-knowledge posture whether you are on Free or Premium: Argon2id and AES-256-GCM on device, optional Google Drive ciphertext sync, and no multi-vault sharing model. Premium via Google Play raises limits and unlocks Chrome passkeys, Archive, and family seats — it does not invent a separate “priority sync” cryptography track. Android does not ship WebAuthn passkey create/sign-in as of September 2026; use Chrome Premium for passkeys. For algorithms and product boundaries, see the security overview and glossary.