You are looking for a Yubikey and `ykman`. This is secure because the secret never leaves the hardware key. This is convenient because you launch a tool with

You are looking for a Yubikey and `ykman`. This is secure because the secret never leaves the hardware key. This is convenient because you launch a tool with a global keyboard shortcut and copy/paste the code. I use `yubikey-oath-dmenu` to allow me to quickly filter to the TOTP code I need.