[BWA-252] Authenticator list display error

[humbleoxygen12]

Steps To Reproduce

1. Turn on "Allow authenticator syncing" in password manager
2. Go to the authenticator list

Expected Result

Items with an authenticator key should appear in the list with the username.

Actual Result

1. Some items show authenticator key instead of username
2. Some items have an empty authenticator key but still appear in the list

Screenshots or Videos

No response

Additional Context

No response

Build Version

© Bitwarden Inc. 2015-2026 Version: 2026.4.0 (1497)

What server are you connecting to?

US

Self-host Server Version

No response

Environment Details

No response

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for your report! We've added this to our internal board for review.
ID: BWA-252

[Krychaz]

Hello there,

Can you please share a screenshot of the error you are receiving?

[pamperer562580892423]

Another user here.

Besides the screenshot @Krychaz asked for - since it's about synced codes, could you add the version info of your BW Android password manager app? - This was only your authenticator app version:

Build Version
© Bitwarden Inc. 2015-2026 Version: 2026.4.0 (1497)

[humbleoxygen12]

Hi, my current password manager version is:
2026.4.0 (21434)

Here is the screenshot. GitHub correctly shows the username, but the other one shows the authenticator key

[pamperer562580892423]

but the other one shows the authenticator key

And that is a valid login item with an existing item name, username and TOTP authenticator key? - I'm also asking because there is another issue with "hallucinated (invalid) TOTP codes" and I wonder if you might be experiencing this other issue (also?)?

[humbleoxygen12]

GitHub is clearly my username, but the masked one shows the authenticator key instead of username or email.

Regarding your example, I have this issue too: the authenticator field is empty, but the Clear button is still shown. I guess there's probably an empty string.

[pamperer562580892423]

but the masked one shows the authenticator key instead of username or email.

Yeah, but then... is there a corresponding login item to it? Does it have a username (that is not the authenticator key)? Or is there not even a corresponding login item for that entry in your authenticator app? If it's the latter, then your issue in fact seems to be the "hallucinating TOTP codes" issue.

Regarding your example, I have this issue too: the authenticator field is empty, but the Clear button is still shown. I guess there's probably an empty string.

Hm, are you talking now about (e.g.) that masked entry from your screenshot? Or are you referring to other TOTP entries? And what exactly do you mean by "Clear button"?

[pamperer562580892423]

PS: If your "list display error" is completely based on "hallucinated TOTP codes", then your issue could probably be closed as a duplicate of this other issue. So please clarify if the display error is based on valid login items with valid username (that are not shown correctly) and valid TOTP codes - or on "hallucinated TOTP codes".

[humbleoxygen12]

Yeah, but then... is there a corresponding login item to it? Does it have a username (that is not the authenticator key)? Or is there not even a corresponding login item for that entry in your authenticator app?

Yep, the item does have a username. So the masked field is the new issue.

Hm, are you talking now about (e.g.) that masked entry from your screenshot? Or are you referring to other TOTP entries? And what exactly do you mean by "Clear button"?

I am talking about the issue you referenced. Some of my items do have an empty authenticator key, but TOTP is still shown. In the screenshots from the issue you referenced, the authenticator key field also has an X button, which is the Clear button. Since it is possible to clear an already empty input field, I guess an empty string is stored in that field, which leads to hallucinated TOTP codes.