chat

This is a good thing to think about. You can do the following:

1. Don't store 2FA TOTP passcodes in your password manager, that makes it not 2FA.
2. Use Authy which has free backup of your TOTP codes encrypted client-side with a password; if you forget this password your TOTP codes will be irrevocably lost. Do not put this backup password in your password manager (for same reason as 1, makes it not 2FA), write it down on a physical piece of paper (or several) and put it some place in your home. Authy prompts you occasionally for this password which is a good way to test that you can get the piece of paper and put in the code correctly.
3. Buy at least two hardware U2F tokens (aka yubikeys, or get one from solo keys); most websites that offer TOTP U2F also support hardware U2F. So if you lose your TOTP codes but still have access to the hardware U2F tokens you should be able to access websites and remove/change the TOTP codes.
4. If you're worried about losing or destroying your hardware U2F tokens, the only real solution is to use a cryptocurrency hardware wallet (yes yes I know, gross, whatever, improved private key management is cryptocurrency's only positive contribution to the world) because those function as hardware U2F tokens but also let you physically write down a series of words on paper that will let you reconstitute the same hardware U2F key in a new crypto hardware wallet if all your hardware U2F tokens (including the wallet) get lost or destroyed. Store this paper in the same place you store your TOTP backup code.
5. If you're really really worried about losing access to your crypto hardware wallet U2F key you can get a blockplate then use a centerpunch to encode your private key by making divots in an actual hunk of metal. Theoretically this will survive a fire.

Hahaahahahhhahahaahha fuck

i use Aegis which is open source, encrypted and can do automatic encrypted exports to phone/cloud storage that other apps can import so you dont get tied to a single device/app/service.

Authy is mostly fine but it ties you to its service (which requires gapps on android phones), doesnt allow exporting, and even if you export it with root workaround they will invalidate all of your tokens if you want to delete your authy account.

I'm keeping my MFA secrets in keepass, don't think about password manager compromise

Vaultwarden or keepass synced to some cloud storage.

I’ve been using 2FAS that allows sync between my android and apple phones. If I make any changes I export an offline backup copy to a usb flash drive.