What happens to your 2FA codes when nobody can unlock your phone

Most digital estate plans stop at passwords. That used to be enough. It is not anymore.

If the bank login needs a six-digit code from an authenticator app on a phone nobody can unlock, the password alone is a dead end. Your family can have the right email and the right passphrase and still sit on the lock screen.

TOTP means time-based one-time password. The app on your phone and the website share a secret. Every thirty seconds or so they both compute the same short code from that secret and the current time.

The code is not the valuable part. The secret behind it is. Lose the phone without a backup of that secret, and you are resetting accounts one support ticket at a time. Die or become unreachable with the only copy on a locked device, and the person you trust most hits the same wall.

SMS codes are a different mess. They depend on a SIM and a carrier recovery process that can take weeks and often requires a death certificate. Better than nothing for some accounts. Still a poor plan for anything urgent.

The authenticator lives only on one phone. Authy, Google Authenticator, Microsoft Authenticator, a hardware token in a drawer. If that device is the only place the secrets live, everything behind 2FA is gated on unlocking it.

The password manager has the login but not the TOTP. Plenty of exports and emergency-access features hand over usernames and passwords. If the TOTP secret never left the phone app, the heir still cannot finish sign-in.

Backup codes were printed once and lost. Those one-time codes from setup day are the official escape hatch. Most people screenshot them into the same phone, or shove the PDF into a folder nobody will open.

Hardware keys with no spare. A single YubiKey in a backpack is strong security and a single point of failure for the people who come after you.

You do not need a perfect system. You need the secrets to exist somewhere your people can reach when the phone is gone.

1. Prefer a password manager that stores TOTP. Bitwarden, 1Password, and several others can hold the authenticator secret next to the login. Then emergency access or family recovery can include working codes, not just passwords.
2. Export or back up authenticator secrets on purpose. If you still use a phone-only app, move the important accounts into the password manager, or keep an encrypted backup you have tested restoring.
3. Put backup codes with the plan, not only on the phone. Print them, or store them where the rest of your instructions live. Treat them like spare keys.
4. Keep a spare hardware key if you rely on keys. One with you, one in the place your person already knows about.
5. Write down which accounts matter. A vault of two hundred logins with TOTP still fails if nobody knows which five to open first. See the digital estate checklist.

HeirVault is not your day-to-day authenticator. Keep that in a password manager if you can.

What it is built for is the handoff layer: the logins, documents, and instructions someone claims after your check-in rules, including TOTP secrets on structured login items so the codes keep working for the person you named. Import from Bitwarden and similar CSV exports can bring the TOTP column with the passwords. Your live vault is protected by end-to-end encryption and encrypts in your browser before upload. That means HeirVault stores ciphertext and cannot decrypt your live vault.

Use a password manager for daily autofill. Use something like HeirVault when you need those credentials, plus context, to reach specific people without them needing your unlocked phone.

Start free, or read how HeirVault compares to Bitwarden if you want the boundary spelled out.

2FA did its job. It also created a second inheritance problem. If the only place the TOTP secrets live is a locked phone, your password list is not a plan. Move the secrets somewhere recoverable, keep backup codes with the instructions, and tell one person where to look.