Question

Emergency kit and 2FA

Forum|Forum|11 months ago
July 11, 2025
2 replies
259 views

Hello Community,

I hope, my question is a simple one. Unfortunately, I was not able to answer it with the help sites or by searching older post here.

How do 2FA and the emergency kit work together, or how don't they?

I created an emergency kit and stored it in a secure location together with the master password for my family to be able to access my 1Password safe in case I ever become incapacitated. Now I plan on switching on 2FA (with an authenticator app). What happens, if they have to access my 1Password safe w/o being able to access the authenticator app.

Will they still gain access only having the emergency kit?
If not, could Recovery Codes be a workaround? Can Recovery codes be setup for an alternate email address? Otherwise, they would still be in a deadlock situation -> To gain access to my email account, they would need to enter my 1password vault and vice versa.

Best regards
Achim

Best Practices

AJCxZ0

In Get to know your Emergency Kit, along with other advice which pertains to this situation, it says,

If you turn on two-factor authentication for your 1Password account, also write down the 16-character secret next to the QR code in case you lose access to your authenticator app.

Depending on the technical skills of your family, they will be able to access your account with the password, secret key and TOTP key, but you might consider other methods to safely share secrets with them and not rely on them being able to access your personal account in the likely stressful and urgent situation. One obvious method is to use 1Password Families.

C

Castler75

This chain of messages has been helpful but I am still unsure about something quoted just above from the "Get to know your Emergency Kit' page - what is meant by "the 16-character secret'? The secret key and the recovery codes are both longer than 16-characters whereas the TOTP (authenticator) code is only six characters, so?

AJCxZ0

Castler75 wrote:
what is meant by "the 16-character secret'?

The six digit code is generated using the standards-based Time-based One-Time Password (TOTP) algorithm uses two inputs: the current time and a secret key. You see the secret key when you first set up the TOTP for a site or service in the form of the QR code and/or a sixteen character alphanumeric string.

This secret key is stored in 1Password or whatever authenticator you use for TOTP. You can see it if you try to edit the field, revealing the URL with a `secret=` parameter, e.g. for this website mine is

otpauth://totp/A.J.Caines%2B1Password%40halplant.com?secret=A0J9RBNS3FJ1NYUK&issuer=1Password&algorithm=SHA1&digits=6&period=30

where A0J9RBNS3FJ1NYUK is the secret key. This is all you need to add a TOTP to another authenticator.

You only need to save the TOTP secret key for 1Password if you only use the 1Password client as your authenticator for your 1Password account, in order to avoid securing your account from yourself.

A

AchimAuthor

Ah, thanks. It is so glaringly obvious now, that I cannot explain, how I was able to overlook it. Really sorry for that. :-/

In regard to 1Password Families, I understand, that I can share logins, notes or even vaults. But my plan was not to give permanent access to all my passwords, but only for a way to access them in an emergency.

AJCxZ0

No apology needed. We've all read right past the exact things for which we were looking only to have someone point it out to us.

The fact that you are planning for contingencies puts you ahead of most. The specific case which you appear to be considering is a tricky one, with the best choices depending strongly on your specific circumstances.
An approach which might help is to not focus on "all [your] passwords", but identify what information would actually be needed by which others in the event that you are temporarily or permanently unable to do all the things necessary to access and use it. For each person you trust with an item in such circumstances, consider the important that they are not just aware, but familiar with the process of retrieving and using the information before being put in a position of having to do so.
There will be some challenging cases, such as access to personal financial resources, where the best option probably isn't sharing login credentials, while cases such as access to service providers for paying bills are much easier.
Since I'm giving unsolicited and somewhat obvious advice, I'll finish with the suggestion that you start with the most consequential items and not insist on solution which will work perfectly until the end of time.

A

AchimAuthor

Thanks again. Looks like I got some work to do. :-D

You're right, that my main concern is, that the situation, where a contingency plan comes to bear, will most likely be a very stressful one. 1Password Families seems like an obvious solution, but I don't have my family there, yet. Be working on it. :-)

Before I switched to 1Password, i used Lastpass. One thing there was the possibility to name emergency contacts, who could, after a latency period, gain access to your vault from their own account. I see, that that comes with its own can of worms security wise, but it had a certain appeal.

Thanks again, I'll get to work now. :-D

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO

Scanning file for viruses.

This file cannot be downloaded