How to share 2FA codes with your team (safely)

1. First: do you need to share at all?

The most common reply when someone asks this question online is "don't share 2FA." That's right whenever the service supports it. Individual logins mean individual accountability, and many services now support them:

• Invite people as users. Google Workspace, Microsoft 365, GitHub organizations, Cloudflare, Stripe, Shopify and most ad platforms let you add teammates or agencies with their own logins and roles.
• Register more than one device. Some services let one account have several 2FA devices. The AWS root user, for example, can have up to eight MFA devices,¹ so two or three trusted people can each register their own.
• Use single sign-on. If the service supports SSO, connect it to your identity provider and manage access there.

If one of these works, use it. The rest of this guide is for the accounts where none of them does.

2. When sharing is unavoidable

Almost every team has a handful of accounts like these:

• Root and owner accounts. The AWS root user, the owner of a Google Workspace or Microsoft 365 tenant, a registrar account that holds your domains.
• Vendor tools without multi-user support. The first admin account on a SaaS tool, an integration user that has to sign in interactively, a supplier portal that issues one login per company.
• Client accounts. Agencies and freelancers working in a client's hosting, DNS or ad accounts when the client can only provide one login.
• Break-glass accounts. Emergency admin accounts kept for when SSO or your identity provider is down.

For these, the real question isn't whether to share. It's whether the code lives on one person's phone, in a spreadsheet, or somewhere with access control and an audit trail.

3. The options, compared

• One person's phone Single point of failure

  Everyone messages that person for a code. Work stops when they're asleep, on a plane or on vacation, and if they leave or lose the phone, the account may need a recovery process that can take days. This is the most common setup, and the one that causes the most lockouts.

• Scanning the QR code onto several phones Can't be revoked

  It works until someone leaves. Their phone still generates valid codes, and the only way to stop it is to reset 2FA on the account and re-enroll everyone. You also can't tell who used the code.

• A spreadsheet or document with the QR code Avoid

  Anyone with the file, or any old copy of it, can generate codes forever. It defeats the point of having a second factor.

• Forwarding SMS or email codes Fragile

  Codes sent by text or email get forwarded by hand or by rules, arrive late, or go to an inbox nobody watches. It helps when a service only offers SMS, but there's usually no record of who used which code.

• A password manager's 2FA field Better

  1Password and Bitwarden can store a 2FA secret in a shared vault, and access can be granted per person.^2,4 The catch is that both are end-to-end encrypted, so the code is calculated on each member's device and the secret is delivered to everyone who can use it.^3,4 A member who copies it keeps working codes after you remove them. Read the full comparison.

• A shared authenticator that keeps the secret Best fit

  The secret is stored once, on a server, and members only see the current six-digit code. Access is granted and removed per person, and every code reveal is logged. That's how TeamsMFA works.

4. What a good setup looks like

Whatever tool you use, check it against this list:

• The secret isn't handed out. People who need a code get the code, not the secret that generates it. Otherwise removing them doesn't remove their access.
• Access is per person. Each person signs in as themselves, so you can grant and remove access one person at a time.
• Every use is logged. You can see who revealed which code and when, not just who signed in.
• There's more than one owner. At least two people can manage access, so one departure or one lost phone can't lock the team out.
• The tool itself is protected. It should use phishing-resistant sign-in such as passkeys, because the tool is now the key to every account in it.
• Recovery codes live elsewhere. Keep each account's backup codes offline or in a separate, restricted vault, in case the tool is unavailable.

5. Moving an existing 2FA code into a shared vault

You can't extract the secret from someone's authenticator app after the fact, and you shouldn't try. Re-enroll the account instead:

1. Sign in to the account with the current 2FA device and open its security settings.
2. Choose to add a new authenticator app, or to reset the existing one. The service shows a new QR code and setup key.
3. Scan that QR code into the shared vault. In TeamsMFA, owners can scan it with their phone's camera, upload a screenshot, or paste the setup key.
4. Enter the code the vault shows to confirm the setup with the service.
5. Remove the old device from the account, so the code on the old phone stops working.
6. Download fresh recovery codes and store them somewhere separate from the vault.
7. Grant access to the people who need it, and add a second owner.

6. When someone leaves: a checklist

• Remove them from every shared vault or team. In TeamsMFA, their access ends immediately, and any request they make after that is refused.
• Check the audit log for the codes they revealed recently, and review those accounts for recent changes.
• If they ever had the secret itself, for example on their own phone or in a password manager they could copy from, re-enroll 2FA on those accounts.
• Change the account passwords they knew.
• Make sure every vault or team still has at least two owners.

7. Common questions

Is it against a service's terms to share 2FA?

Some services require each person to have their own login, so check the terms before sharing, and prefer individual users wherever they're available. Sharing is common for root, owner and vendor accounts that only allow one login.

Can several people use the same authenticator code at the same time?

Yes. A 2FA code is calculated from the secret and the current time, so everyone generating it from the same secret sees the same code during each 30-second window.

What about passkeys and hardware keys?

Passkeys and hardware security keys are tied to a device or a person and can't be shared like a 2FA code. Where a service supports them, give each person their own. Shared authenticator codes are for accounts that only offer a code.

Sources

1. AWS: AWS Multi-factor authentication in IAM ("can register up to eight MFA devices")
2. 1Password Support: Use 1Password as an authenticator for sites with two-factor authentication
3. 1Password: The architectural reason 1Password can't read your vault data
4. Bitwarden: Hidden passwords: Control credential visibility across your organization