Apple's verification codes: iCloud Keychain, passkeys, and Mac 2FA

Search any Apple forum thread titled "Apple 2FA not working" and you will find three different arguments in the same conversation. One person means the popup that appeared on their iPhone when they signed into iCloud on a new Mac. Another means the six-digit verification codes the Passwords app offers to store for third-party websites. A third means passkeys and has stopped typing codes entirely. All three get called Apple 2FA, and only one of them is TOTP.

This post untangles the three, shows where each lives in your settings, and spends some time on the Mac angle — because keeping your second factor on the machine you actually log in from is a quietly excellent idea.

The three things people call Apple 2FA

First: Apple Account two-factor authentication. This is the system-level protection for your Apple Account itself — your password plus a six-digit code pushed to your trusted devices, or sent to a trusted phone number. It is the default security method for most accounts, and a hard requirement for Apple Pay and Sign in with Apple. Apple renamed the Apple ID to Apple Account, but most people still say Apple ID 2FA, and they mean this. It is not TOTP. There is nothing to scan, nothing to export, no third-party site involved.

Second: verification codes in the Passwords app. These are genuine time-based one-time passwords for other companies' sites — Google, GitHub, your bank — generated with the same standard every authenticator app uses, and stored and autofilled by Apple's password manager. The Passwords app arrived with iOS 18, iPadOS 18, and macOS Sequoia, and Apple's documentation covers the setup path.

Third: passkeys in iCloud Keychain. FIDO2 credentials synced across your Apple devices, approved with Face ID or Touch ID — a different animal from either of the first two. Biometric 2FA explains what the Face ID step actually proves, and the hardware keys guide covers the FIDO2 machinery underneath.

The trusted-device popup

The flow, verified against Apple's support pages: you sign in with your Apple Account password on a new device or browser, and a notification appears on your trusted devices showing the approximate location of the attempt. Tap Allow, and a six-digit code displays on that device. Type the code where you are signing in, and you are through. If no trusted device is reachable, the code goes by text or phone call to your trusted phone number — and on iPhone, Apple will sometimes verify the number silently in the background so you never see a code at all.

As 2FA goes, this is decent. The codes display on hardware you already own, tied to devices signed into your Apple Account, and there is no seed to steal because Apple generates them itself. Two soft spots are worth naming. The SMS fallback inherits every SIM-swap concern that applies to texted codes anywhere. And the whole system assumes your trusted devices are charged, online, and in your possession — a dead iPhone and a forgotten password make for a slow afternoon.

It also protects exactly one account: Apple's. You cannot point a third-party website at this system, which is by design, and which is why the second thing on our list exists.

Verification codes in the Passwords app

Here is the current path. Open the Passwords app, select All (or search), and pick the website's entry. Under Security, choose Set Up Verification Code — then scan the site's QR code or type in the setup key it shows you. From then on, the current six-digit code appears right on that entry, and iOS offers it as an autofill suggestion whenever a login field wants it. A Delete After Use setting clears spent codes from the suggestions, per Apple's guide. On the Mac, the Passwords app has the same entry, the same Security section, and the same setup flow.

Where iCloud Keychain TOTP shines: system-level autofill across iPhone, iPad, Mac, and Vision Pro, with the entries syncing through iCloud Keychain's end-to-end encryption. One less app, one less vault to fund, and the codes sit exactly where the passwords already are.

Where it does not shine: anywhere Apple did not build. On Windows, your codes autofill in Chrome, Edge, or Firefox only after you install iCloud for Windows and enable the iCloud Passwords browser extension — a flow that involves signing in and confirming a six-digit code in a pop-up, per Apple's instructions. Editing a stored verification code means opening the iCloud Passwords app on Windows, a separate procedure. On a locked-down work PC or any Linux machine, the codes are out of reach entirely. This is ecosystem gravity in its purest form: the feature works beautifully inside the orbit and nowhere else.

The macOS angle: keeping codes on the Mac

Mac users get the Passwords app from Sequoia onward, so the built-in macOS 2FA option is simply there. The alternative worth knowing about is a browser-installed PWA, because it splits your second factor away from any single vendor's sync system.

2FA by DependsiT runs in any modern browser and installs on the Mac as a real app — its own window, its own icon, and full offline operation after the first load. The guest generator needs no account: paste a Base32 secret, an otpauth:// URI, a QR code image, or a Google Authenticator export, and codes appear instantly, computed entirely in the page — zero network requests, nothing stored, and a reload clears everything. The vault adds encrypted storage for entries that live on past a reload: encrypted on-device before upload with PBKDF2 salted derivation, HKDF key separation, and AES-256-GCM, with Argon2id protecting login, so the server holds only ciphertext. It handles TOTP, HOTP, and Steam Guard, with per-key algorithm, digits, period, and counter.

The honest trade-off: the Passwords app means one ecosystem, one autofill, total convenience. A separate generator means your codes are portable to any machine with a browser — including the Windows box at work — and your second factor is not stored by the same company that holds your passwords. For a fuller map of that landscape, the 2026 authenticator comparison ranks the options.

Passkeys in iCloud Keychain

A passkey is a FIDO2 credential: a key pair generated on your device, private key kept in the secure hardware, public key registered with the site once. Approve with Face ID or Touch ID, and the login is a signed assertion — no code at all, and, as with any FIDO2 credential, a signature that only verifies for the real domain. Apple syncs passkeys end-to-end through iCloud Keychain to every device signed into your account, and Apple's setup guide walks through enabling that sync.

The part people find magical is cross-device sign-in, and it is worth understanding because it is not magic. Say you are at a Windows PC in a hotel business center and need to sign into a site where your passkey lives on iCloud Keychain. You choose the passkey option, select something like "Passkey from nearby device," and the PC displays a QR code. You scan it with your iPhone, the two devices perform a Bluetooth proximity handshake — the phone must be physically near the computer — and then Face ID approves the sign-in. Apple documents the flow in its passkeys guide. The Bluetooth requirement is the security mechanism: it is what proves the phone and the PC are in the same room, which is what stops a remote attacker from relaying the exchange. It is also why the flow fails quietly when Bluetooth is off on either device.

Which Apple setup for which account

Your Apple Account itself: leave the trusted-device system on. You bought the ecosystem, and the popup flow is well matched to the account that controls all your other devices.

Your email: the account that can reset everything else, and therefore the one that deserves the strongest factor you will actually use. For Gmail specifically, Gmail 2FA setup walks through the options — and note that Google fully supports security keys and passkeys, so the strongest route there does not involve Apple's TOTP storage at all.

Third-party sites: use verification codes in the Passwords app if your hardware is all Apple, a cross-platform authenticator if it is not, and a hardware key for the few accounts where phishing resistance is worth real money. There is no single right answer. There is a wrong one, and it is SMS.

Frequently asked questions

Is Apple's two-factor authentication the same as TOTP?

No. The Apple Account system pushes codes to your trusted devices or your trusted phone number, and Apple generates them on its own infrastructure — there is no shared secret, nothing to scan, nothing an outside site can use. TOTP appears in the Apple picture only in the Passwords app, which stores verification codes for third-party websites. The distinction matters for troubleshooting: one lives in Settings under Sign-In & Security, the other in the Passwords app.

How do I move my verification codes into the Passwords app?

One site at a time. On the site, enable two-factor authentication and get its QR code or setup key. Then open Passwords, select the site's entry, and under Security choose Set Up Verification Code — scan or type, and the entry starts showing the current code. Confirm the new code matches the one in your old authenticator before you remove anything, and keep the site's recovery codes somewhere safe. Do this while the old app still works, not after you delete it.

Do Apple verification codes work on Windows?

Yes, with an asterisk. You need iCloud for Windows, the iCloud Passwords extension for Chrome, Edge, or Firefox, and an Apple Account sign-in confirmed by a six-digit code in a pop-up. Once enabled, passwords and verification codes autofill in those three browsers. On a machine where you cannot install any of that — a locked-down work PC, a Linux laptop — your Apple-stored codes are unreachable, which is the ecosystem gravity problem in a single sentence.

Are passkeys safer than verification codes?

Yes, meaningfully. A passkey's signature only verifies for the real domain, so a relay phishing page collects nothing usable, while a TOTP code typed into a convincing fake works perfectly. Passkeys also cannot be reused across sites, since each one is its own key pair. Verification codes remain the fallback everywhere passkeys are unsupported, and both beat SMS by a wide margin. In practice the two coexist: passkeys where offered, codes for the long tail.

What happens to my codes if I switch away from iPhone?

iCloud Keychain stops syncing to your new hardware, and the practical exit is re-enrollment. On each third-party site, use your recovery codes — or temporarily disable and re-enable 2FA — to enroll a fresh secret in your new authenticator, one account at a time. Plan the move while both devices still work, keep each site's recovery codes printed, and start with the accounts that matter most. It is an afternoon of tedium, not an emergency, if you sequence it that way.

However you arrange Apple's three systems, the guest generator is the fastest way to see a code without committing to any of them: open it in Safari on your Mac, paste a secret or a QR image, and the six digits appear — computed in the page, stored nowhere, gone on reload.