I was going to add something on Duo before seeing that. If you have to use OTP with it, rather than FIDO, which I guess costs more, as my site doesn't support

I was going to add something on Duo before seeing that. If you have to use OTP with it, rather than FIDO, which I guess costs more, as my site doesn't support it, the hacks are fairly straightforward. On an Android phone, register a "tablet" (at least in the interface I see) using https://f-droid.org/en/packages/net.scintill.duotp/ https://f-droid.org/en/packages/net.scintill.duotp/ and then use Aegis with the secret. (Why do people persist on suggesting Google Authenticator?) On a desktop, see https://github.com/simonseo/nyuad-spammer/tree/master/spammer/duo https://github.com/simonseo/nyuad-spammer/tree/master/spamme... with an appropriate value of "start.nyu.edu". I use the secret with pass otp. Note that this is HOTP, not TOTP, so if you use the same secret on multiple devices, you need to synchronize the counter somehow, perhaps with a git hook under pass. (There are more baroque hacks to get the secret that I started with before finding those solutions.) If you do want something like Duo for an organization, possibly self-hosted, and free-software-friendly, then https://www.privacyidea.org/ https://www.privacyidea.org/ looks like a good option, but i have no experience with it.