Updated 2026-09-26
A login item can hold an authenticator key — the same shared secret a phone authenticator app uses — so Atrium can generate that site's one-time code itself. This is separate from signing in to your own Atrium account with an authenticator app; it's for the two-step codes other sites ask you for.
Adding a key to a login
Open a login item to edit it and add the authenticator key either way:
- Paste it. Most sites show a base32 secret ("set up manually") alongside their QR code — paste that.
- Scan it. Take a screenshot of the site's QR code and choose it as an image; Atrium reads the QR code in your browser and fills in the key. The image is never uploaded anywhere.
Either way, Atrium accepts a bare secret or a full otpauth:// URI, and reads the algorithm, code length and refresh period out of it when the site specifies non-default ones (most use SHA-1, 6 digits, every 30 seconds).
Using the code
Once a key is saved, the login shows a live code: a compact chip in the vault list, or the full code with a countdown ring on the item itself. Click either to copy the current code — the clipboard clears itself 20 seconds later, the same as a copied password. The code is computed fresh in your browser every second; nothing about it is sent to our servers.
Where it's stored, and what we can see
The authenticator key is a field on the login item, so it's encrypted on your device along with everything else about that item before it's uploaded. We can see that a login item exists and roughly when it changed; we can't see the key or read any code from it. See what we can and cannot see for the full picture.
An authenticator key travels with the item through import and export too — most exports from other password managers that store one carry it over.