I would say that the "generic desktop app" approach is to be avoided. The reason is that there is a strictly better alternative that targets almost the same aud

I would say that the "generic desktop app" approach is to be avoided. The reason is that there is a strictly better alternative that targets almost the same audience. By implementing a TOTP generator as a desktop browser extension instead, one gets visibility into which site the user visits, and can show only the relevant code, or, if there is none, a phishing warning. The users that are left behind in the browser extension approach are those who need TOTP for non-web things like SSH. Happy user of https://authenticator.cc/ https://authenticator.cc/