Long ago, I used Google Authenticator to store 2FA tokens without giving it much thought. When I lost the app data to a phone reset, I also lost my 2FA tokens.

Long ago, I used Google Authenticator to store 2FA tokens without giving it much thought. When I lost the app data to a phone reset, I also lost my 2FA tokens. Got lucky I didn't have many tokens saved at the time and was able to restore all the important accounts despite losing the tokens. Even though it was my fault for not reading the T&C of the Google Authenticator app, I cursed Google for creating an inferior product on an OS they controlled. What was the use of requiring login with a Google account on the Android device if you are not going to persist this kind of data. Then I moved to Authy which syncs and stores your tokens online to their cloud, allaying all the fears I had from previous experience. Incidentally another phone reset happened. Now Authy allows you to access your tokens "locally" to any device that can install their app or browser extension. Using more than one "device" locally gives you data redundancy. I cannot just trust a browser extension with my 2FA tokens (yikes), so at the time I only had my Android device with the tokens locally. When this "trusted device" (read app data) was lost I had to request support for a reset to gain back my data from Authy. That process takes 48 hours after initiating the reset. (The app data counts as a device, not the other way around; this is the crux of my problem with 2FA application design.) As soon as I got my tokens back I moved to Aegis and never looked back. I can export backups, save them encrypted on any location and import them anytime without fear of losing app data aka device.