The one I've had to use (and find reasonable) is to have "trusted devices". That's how it works, at least with 1Password: - You log with your 2FA into a device

The one I've had to use (and find reasonable) is to have "trusted devices". That's how it works, at least with 1Password: - You log with your 2FA into a device. - You set this device as trusted. - In case you lose your phone or 2FA device, log onto the trusted device and disable 2FA. - Then set up 2FA again with new phone or device. It's not perfect, but it's workable. For instance, while I won't enable trusted device on my laptop, having my desktop stolen is a way rarer occasion, so I enable the "trust this device" options. It's just a matter of thinking on the threat model and where you can place spots for recovery while loosing as little security as possible.