Apple Passwords vs an authenticator app for 2FA

Since iOS 15, your iPhone can make two-factor codes itself, with no extra app. From iOS 18 they live in Apple's Passwords app, which keeps "passwords and passkeys, Wi-Fi passwords, and verification codes all in one place" (Apple). So do you need a separate authenticator app? It depends on what matters to you. Here's an honest comparison.

How Apple Passwords handles codes

Adding a code. Scan the QR code a website shows on another screen. In recent iOS versions you can also touch and hold a QR code on a website and choose Add Verification in Passwords, or enter the setup key by hand (Apple).
Using a code. When a website asks for it, the code appears as a suggestion above the keyboard (AutoFill). You can also copy it from Passwords.
Sync. Codes are part of iCloud Keychain. Apple says "verification codes are synced across all of a person's devices" (Apple, WWDC21). Passwords and Keychain data is end-to-end encrypted, even without Advanced Data Protection (Apple).

Side by side

	Apple Passwords	Authenticator App - Novaz
Where the codes are	Every Apple device signed in to your Apple Account with iCloud Keychain on	Only the iPhone you added them on
New or lost iPhone	Codes come back through iCloud Keychain	Codes don't come back: set up 2FA again, or use backup codes
AutoFill above the keyboard	Yes	No (version 1.0.3)
Kept apart from your passwords	No: same app, same account	Yes: a separate app, no account
Moving codes to another app	iOS 26 has a standard way to move "verification codes" between apps (Apple, WWDC25), if the other app supports it	No export in version 1.0.3

When Apple Passwords is the better choice

You use Apple devices and iCloud Keychain already.
You want codes on your iPhone, iPad and Mac, and you want them back automatically on a new iPhone.
You like codes filling in by themselves.

For most people in Apple's ecosystem, that's a strong combination. The sync also protects you from the most common 2FA disaster, losing the only phone that has your codes.

When a separate authenticator app makes sense

You'd rather not keep passwords and 2FA codes in the same place. If someone gets into your Apple Account and its passwords, codes in Passwords are there too. A separate app on one device keeps the second factor separate.
You don't use iCloud Keychain, or you don't want your 2FA secrets synced to any cloud, even an end-to-end encrypted one.
You want a lock just for your codes, separate from your iPhone passcode.

The trade-off is real: a codes-on-one-phone app like Novaz means you must keep backup codes, because a lost phone means lost keys. See Lost the phone with your authenticator app?

Choosing which app fills in codes

From iOS 18.2, you can pick the app that AutoFill uses for passwords and codes: open Settings, then Apps, Default Apps, and Passwords & Codes. Apple notes that the app you choose has to support this (Apple). Novaz 1.0.3 doesn't offer AutoFill, so it doesn't appear there. You copy its codes instead.

Using both

You can. Some people keep everyday accounts in Passwords for the convenience, and their most important ones, such as email and banking, in a separate authenticator app. When you add an account to two apps, both make the same codes, because they share the same setup key. Scan the QR code with each app during setup.

Things Apple doesn't document

Apple's help pages don't say whether Passwords supports codes with 8 digits, 60-second intervals, or SHA-256 and SHA-512, or counter-based (HOTP) codes. If a service uses unusual settings, check that the codes work before you rely on them.