Yubico Authenticator and cryptostick.oauth are the only open solutions I am aware of that one can easily verify don't ever expose your secret key. Both of cour

Yubico Authenticator and cryptostick.oauth are the only open solutions I am aware of that one can easily verify don't ever expose your secret key. Both of course assume you have the secret key on a Yubikey, Nitrokey or similar. Any app-only TOTP solution has to expose your private key somewhere by design and thus are best avoided in favor of hardware-backed solutions when possible.