Short answer: Give everyone their own login wherever the platform allows it. For the accounts that only have one login, keep the 2FA secret in a shared vault that sends each person the current 6-digit code, never the secret itself. That way everyone can sign in, every use is logged, and you can cut one person off without resetting anything.
Most teams don't decide to share 2FA. It just happens. A client hands over their ad account, the founder set up the AWS root login years ago, or the supplier portal only has one admin seat. Then someone turns on two-factor authentication, and suddenly a 6-digit code on one person's phone stands between your whole team and their work.
This guide covers the five ways teams handle that, what each one costs you, and how to set up the one that holds up.
First, check you actually need to share
The best shared login is the one you don't have. Before you share 2FA on anything, check whether the platform lets each person have their own access:
- Ad platforms like Meta Business and Google Ads have partner and manager accounts. Agencies can be added as a business, and each person signs in with their own 2FA.
- Cloud providers like AWS and Google Cloud have per-user identities. The root or owner account should almost never be used day to day.
- Seller and store platforms like Amazon Seller Central and Shopify let you invite users with their own permissions.
- Your own tools almost all support individual seats now.
Per-user logins give you the best audit trail for free, and nobody has to share anything. Use them wherever they exist.
What's left are the accounts that really do have one login: root and owner accounts, client-owned logins you can't add users to, vendor portals with a single admin, shared inboxes, and the social accounts a client gave you a password for. That's where this guide comes in.
The five ways teams share 2FA
1. The phone in the drawer
One phone holds the authenticator app. Whoever needs a code asks the person who has it, or walks over to the drawer.
It's simple, and the secret only exists in one place. But it breaks the moment the phone's owner is asleep, on leave, or in a different time zone. There's no record of who asked for which code, and if the phone is lost, everyone is locked out at once.
2. The same QR code on every phone
When you set up 2FA, everyone on the team scans the same QR code, so each phone generates the same codes.
This is the most common setup, and it works until someone leaves. Each scan made a full copy of the secret key. When a teammate walks out the door, their copy goes with them, and there's no way to switch it off except resetting 2FA on that account. Most teams don't know how many copies exist, or where.
3. SMS to a shared number
2FA codes go by text to one number: a work phone, a VoIP number, or a forwarding service.
Text messages are the weakest form of 2FA. They can be intercepted or redirected by a SIM swap, and forwarding adds more places for the code to leak. If the platform offers an authenticator app, switch to it.
4. A shared password manager vault
Password managers like 1Password and Bitwarden can store a 2FA secret next to the password and show the current code. Put the item in a shared vault and the whole team gets codes.
This is a real step up, and if your team already lives in a password manager it's a reasonable choice. The trade-offs: anyone who can edit the item can usually see the setup key behind the code, the password and the second factor now sit in the same place, and the logs show who opened an item, not necessarily who used a 2FA code.
5. A shared authenticator vault
A dedicated shared 2FA tool (Fox Auth, and others like it) stores the secret key on the server, encrypted, and sends each teammate only the current 6-digit code. You decide which codes the whole team can see and which are yours alone.
Because nobody ever holds the key, removing a person removes their access completely. Every reveal is logged with who and when. And because the codes are built into a browser extension and a desktop app, nobody has to unlock a phone to sign in.
Side by side
| Phone in a drawer | Same QR on every phone | SMS to a shared number | Password manager | Shared 2FA vault | |
|---|---|---|---|---|---|
| Works when one person is away | No | Yes | Sometimes | Yes | Yes |
| Copies of the secret | 1 | One per phone | None (carrier) | Readable by editors | 1, on the server |
| Know who used a code | No | No | No | Partly | Yes, every reveal |
| Cut off one person | Take the phone back | Reset 2FA | Change the number | Remove from vault, then reset 2FA if they saw the key | Remove them, nothing to reset |
| Phishing-resistant | No | No | No | No | No |
Nothing on this list is phishing-resistant. That needs passkeys or security keys, which are tied to one person and can't be shared. For your most sensitive personal logins, use those. For the shared ones, a vault is the safest practical option.
How to set up shared 2FA in Fox Auth
Here's the setup end to end. It takes about as long as a coffee.
- Create your team. Sign in at app.foxauth.com with Google or your work email, name your team, and start the 14-day trial.
- Add a 2FA code. Click Add token and scan the QR code with your webcam, drop in a screenshot, or paste the setup key. If the QR code is on a web page, the Chrome extension can scan it from the tab, and the Mac app can scan it from your screen.
- Choose who can see it. Every code is either Team or Only me. Personal accounts can live in the same vault without anyone else seeing them.
- Invite your team. Send invites from Members. Choose admin or member for each person. Members use the shared codes but never see the secret key.
- Sign in as usual. On a login page, the Chrome extension finds the matching code and fills it in. On a Mac, press ⌃⌥⌘F to open the menu bar app and copy a code. Or reveal it in the web app.
Moving from Google Authenticator? Fox Auth reads its export QR codes directly. Here's the step-by-step migration guide.
Five rules for sharing 2FA safely
Whatever tool you use, these keep shared 2FA sane:
- Share the code, not the secret. The fewer copies of a setup key exist, the less you have to clean up later.
- Share only what can't be split. If a platform supports separate logins, use them. Shared 2FA is for the leftovers.
- Keep personal accounts private. Your own bank login doesn't belong in a team's view, even in the same tool.
- Store backup codes separately. Recovery codes are the keys to the kingdom. Keep them with the account owner, not in the shared vault.
- Plan the leaving day now. Know where every 2FA secret lives so that when someone leaves, you know exactly what to change. Our offboarding checklist walks through it.
When Fox Auth isn't the right fit
We'd rather you pick the right tool than the wrong one:
- If everyone can have their own login, you don't need shared 2FA. Use the platform's users and roles.
- If an account uses a security key or passkey, it's tied to a device and can't be shared through any vault, including ours. That's by design.
- If an account uses push approvals (tap "Yes, it's me" on a phone) instead of a 6-digit code, a shared vault can't approve them. Check whether the account can use an authenticator app code instead.
For everything that shows a QR code when you set up 2FA, a shared vault works. It's built for agencies, MSPs and IT consultants who look after logins for other people. If you're weighing tools, our guide to the best team authenticator apps compares the main options honestly, and you can see how Fox Auth compares to Daito.
Still wondering whether sharing 2FA defeats the point? We wrote a whole post on that: Is sharing 2FA safe?
Frequently asked questions
Can more than one person use the same 2FA account?
Yes. A 2FA code comes from a secret key, and anyone who can generate the code from that key can sign in. The question is how you share it: copying the key onto several phones works, but you can't see who used it or take it back. A shared vault keeps the key in one place and hands out codes instead.
Can I share Google Authenticator with my team?
Not directly. Google Authenticator is built for one person. You can export accounts to another phone, but that makes another full copy of the secret. To share with a team, move the codes into a shared vault and give teammates access there.
Is it safe to share 2FA codes over Slack or email?
Sending a single code that expires in 30 seconds is low risk but slow, and someone has to be awake to send it. Never send the QR code or setup key in chat: anyone who scrolls back can generate codes forever.
What happens to shared 2FA when someone leaves?
If the secret was on their phone, you need to reset 2FA on every account they had. If they only ever received codes from a shared vault, remove them from the team and they lose access straight away. See our offboarding checklist.
Does shared 2FA work with SMS codes?
SMS codes go to one phone number, so they're the hardest to share. Where a site offers an authenticator app as an option, switch to it. It's more secure than SMS and it can be shared properly.
