Need to share a 2FA code? Temporary links and their limits for small teams

When a teammate is away or several people must sign in to one account, choose between personal access, a shared vault, and a temporary code link, and learn what the link cannot do.

What situation are you in?

These are common moments in a small team:

• The person who holds the 2FA codes is on vacation, and nobody else can sign in.
• Several people need to sign in to the same account for a short time.
• A client's account sends codes to one person, and work stops until someone passes the code on.

The right tool depends on how long the access is needed and how many people need it. The sections below go from the first thing to check to the last.

First, check personal accounts and delegation

If the service lets you add users or delegate access, use that. Each person then signs in with their own account and their own second factor, and the service can show who did what.

Google does not recommend sharing an account. See Google's guidance on shared accounts. For a shared mailbox, many services have a separate feature for it. Look in the service's admin or help pages before you share a login.

For ongoing access, use a shared vault

If several people need access again and again, and you must be able to remove a person's access when they leave, use a shared vault that has permission management, such as the organization feature of a password manager. Bitwarden's page on onboarding and succession is one example of how such a setup is planned.

Removing a person from a shared vault does not take back what they already copied, and it does not end sessions they are already signed in to. Bitwarden's page says the same and advises updating the credentials a member had access to. When someone leaves, change the password and the 2FA secret in the service itself and end their sessions there.

Popout does not manage users. It has no member list and no way to take access back from a person.

For a one-time hand-off, use a Popout code link

If someone needs a code once or for a short time, you can send a Popout code share link. What it contains and how it works:

• The link does not hold the secret key. It holds a bundle of codes that Popout calculated ahead of time, scrambled (encrypted) inside the link.
• You choose how long the codes last: 5, 15, 30, or 60 minutes.
• Time-based (TOTP) accounts can be shared. Other account types, such as HOTP, cannot.
• The other person does not need to install the extension. The link opens a plain web page.
• You can lock the link with a password. Send the password by a different route than the link, for example by phone while the link goes by chat.

For the steps to create a link, see Share a code with a link.

Limits you must know

• You cannot cancel a link. The codes are already inside it, and there is no server where you could switch it off.
• A link can be copied and forwarded. A password limits this, but a person who knows the password can pass it on too.
• A link is not tied to a person or a device. Anyone who has it can open it during the time.
• Popout keeps no record of links you made. You cannot look up later who received a link or who opened it.
• Expiry does not end a session. When the time is over, the page shows no more codes, but a person who already signed in stays signed in until the service ends that session.
• A link does not protect against phishing. A code that someone types into a fake page can be used by the attacker. See CISA's fact sheet on phishing-resistant MFA.

Whether sharing an account fits a service's terms of use is for you to check with that service.

Related guides

• Share a code with a link: the steps and options for creating a link.
• Moving from Authy Desktop and other apps: if your team's codes are still in another app.
• Backup, export, and sync: to keep your own accounts on more than one of your devices.