What the author actually did
Carrasqueira's complaint is familiar. Authenticator apps such as Google's and Microsoft's mostly live on smartphones. If you lose the phone, you can lose access to the accounts that depend on it. Even on a normal day, fetching a phone that is charging in another room just to read a six-digit code is irritating.
His fix is to keep the codes in Bitwarden. With the integrated authenticator, a desktop login can prompt for the current 2FA code in the same flow as the username and password. On mobile, he says, Bitwarden copies the code to the clipboard during autofill, so you paste it rather than having it filled in.
He also uses Vaultwarden, a self-hosted server that he says gives him premium features without a subscription. He reports that saving passkeys to Bitwarden works well on PCs but not in mobile browsers.
Two Bitwarden products that are easy to confuse
Bitwarden has a standalone Bitwarden Authenticator app and an integrated authenticator inside the Password Manager vault. They are not the same thing.
- Integrated authenticator: This is a TOTP field inside a login item in your vault. It is available to Premium and organization members, and it autofills the code alongside your username and password.
- Standalone app: This is a separate mobile app. Installing it does not by itself move your codes into the vault. You choose where each code is saved.
- Free tier: Reporting from one third-party guide says the free tier displays the current TOTP code in the vault entry, refreshing every 30 seconds. That conflicts with other guides that treat TOTP storage as a paid feature. Bitwarden's own help pages are the authority here, so check the current plan details before you rely on either claim.
- Price: Bitwarden's own pricing page lists Premium at $19.80 per year ($1.65 per month, billed annually) — up from the long-standing $10 per year after a 2026 price rise — which is the context for the author's "free via Vaultwarden" route.
How autofill behaves in practice
Bitwarden's help documentation describes browser autofill like this:
- With the integrated authenticator, the browser extension autofills your TOTP code when you use the context menu, keyboard shortcuts or manual autofill.
- If you use the autofill shortcut, the TOTP is automatically copied to the clipboard after autofill. Press Ctrl+V to paste it.
- A recent WindowsForum guide says the extension copies the current code to the clipboard when you autofill that login, and that this is the default. The toggle is under Settings > Autofill, labelled "Copy TOTP automatically."
- The same guide advises considering turning that setting off if Bitwarden is your authenticator. The reasoning is that a code sitting on the clipboard is exposed to clipboard managers and history tools. Windows users who run Clipboard History should take that seriously.
A practical checklist for a migration:
- Install the browser extension and confirm the login item has the right website address saved.
- Add the authenticator key to each login, either by scanning the QR code or by entering the key by hand.
- Test a full sign-in from a second device before you remove the old authenticator entry.
- Review your autofill settings, including whether to keep automatic TOTP copying on.
Why "losing my phone isn't a disaster" needs a footnote
Moving codes to a synced vault does improve availability. It does not remove the dependencies. The sections below are my own analysis of how this kind of setup works. They are not findings from the author or from Bitwarden.
- Vault access still matters. If your recovery path runs through the same phone, you have only moved the problem. Make sure you can reach the vault from a second device and that you can restore it without the lost phone.
- A self-hosted server is a single point of failure you own. If the home server, the storage, the network or the remote-access setup fails, your codes may be unreachable at the moment you need them. The author suggests a reverse proxy and something like Tailscale for outside access. That adds more parts to maintain.
- Backups are your job. Nothing in the author's account says he has tested restoring his Vaultwarden data. Treat a tested, protected backup as part of the setup.
- Passwords and second factors end up together. Putting both in one vault trades some security separation for usability. Someone who gets into the vault gets both factors for those accounts. Keeping high-value accounts on a separate factor, such as a hardware key, is a reasonable response.
Vaultwarden is not official Bitwarden
The Vaultwarden project describes itself as an unofficial alternative. Its GitHub page calls it an alternative server implementation of the Bitwarden Client API, written in Rust, and says that bugs should be reported to Vaultwarden rather than to Bitwarden's official support channels. The project's feature list includes authenticator-based two-factor authentication and an admin backend. It also warns that the web vault needs HTTPS and a secure context.
So the "premium features for free" claim is the author's experience with an unofficial server, not a Bitwarden pricing rule. Compatibility with official clients is not guaranteed in the way it is with Bitwarden's own server. If you use Vaultwarden, you are taking on update, patching and exposure risk that a hosted service would handle for you.
Where Microsoft Authenticator fits
Moving codes out of Microsoft Authenticator is not always a simple copy. I did not verify Microsoft's current export and migration options in this research. As general industry knowledge, standard TOTP entries can be re-enrolled with a new authenticator app. Work or school accounts managed through Entra, and any sign-in that relies on push approval, may need to be re-registered through your organization's process. Check with your IT admin before you remove anything.
Bottom line
The idea is sound. A synced vault that fills in 2FA codes on a PC is more convenient than reaching for a phone, and Bitwarden's documented behavior supports the author's description of desktop autofill and mobile clipboard copying. The headline overreaches, though. Phone loss stops being a disaster only if you have tested recovery, kept backups and held on to your service recovery codes. If you self-host, you are also running the server that holds your keys.
Correction (October 22, 2026): This article originally stated Bitwarden Premium costs $10 per year. Bitwarden's own pricing page lists Premium at $19.80 per year ($1.65/month, billed annually) following a 2026 price rise from $10.