Yubico Authenticator

Moving TOTP secrets off the device and into hardware is a meaningful security upgrade over any phone-based authenticator. If your phone is stolen or your computer is compromised, an attacker still cannot generate codes without the physical YubiKey. The catch is the dependency: you must own a compatible YubiKey, and losing the key without a backup means losing access to all accounts stored on it. That makes backup discipline non-negotiable. For users who already carry a YubiKey for passkeys or SSH, this is the obvious companion app; for everyone else, the hardware cost and backup requirement raise the bar compared to apps like Aegis.