Also, while it defeats the 2FA somewhat, you can activate TOTP in your KeePass entries, obviating the need for a third authentication app. If you really want t

Also, while it defeats the 2FA somewhat, you can activate TOTP in your KeePass entries, obviating the need for a third authentication app. If you really want to be superstrict, you can have one KeePass database with your passwords, and another, with a different master passwords, for your TOTPs. It's less convenient, but it still stays completely under your control. Except for Apple, which rolled their 2FA in their own, incompatible way... for your convenience and safety, of course.