Twilio confirms data breach after hackers leak 33M Authy user phone numbers 2 years ago
If you do not need QR codes, oathtool is great. You can protect your tokens, recovery codes etc. with gpg -c or similar, so the encryption is entirely separate from the authentication mechanism.
And you actually know what is going on. Works for GitHub.