I like a combo of Yubikey and Bitwarden, personally.

Have you ever used HOTP before? Convenience-wise, it's much worse than TOTP. It's not supported by popular apps, you can't use it on several devices unless there's synchronization, you never know if the code you're looking at was used already.

If you have a rooted phone, Aegis can import from several other apps, including Authy, automatically.

But don't try to root your unrooted phone to unlock that capability. Rooting requires wiping the device, so you lose your data in the process.

Someone already explained it, but here's a ranking of the different methods which are commonly used in terms of security, from bad to good:

• No 2FA
• SMS/Phone-based TOTP (TOTP = the normally 6 digit code)
• App-based TOTP
• Hardware-token-based TOTP
• Hardware-token (Fido2/WebAuthn/Passkeys)

On top of all the other good answers, someone can also just SIM hijack your phone number by social engineering your phone provider into activating a new SIM card.
And it's usually much easier than one would think/hope.

SMS-based can be intercepted, while app-based are calculated on your phone. If you're using SMS -based, all someone needs to do is take over your phone, and they're getting your 2FA codes. Here's how easy that is: https://m.youtube.com/watch?v=lc7scxvKQOo

Cause SMS is not encrypted, so your phone provider and any routing company like this one can read your texts, phone numbers can be spoofed (not sure about this one), or stolen via social engineering (someone calls your phone provider claiming it's you and u lost your phone or something, then gets access to your number).

There's probably a lot more issues with it, i don't remember them atm, but should be pretty easy to find with a search if you're still curious.

SMS 2fa has been recommended NOT to use since 2016.

Yep SMS two factor authentication usage was officially suggested to no longer utilize by NIST in 2016, and in practice before that, to your point.

This shit is old, people! It's trivial to compromise. Start transitioning where you can to passkeys and start using an app based MFA, like Duo or Authy, both free.