KeePassXC can store TOTP secrets in the same encrypted database as your passwords. The browser extension can type the code. There is no second cloud and no second app from this team. The threat model matches the password vault: whoever can open the file can mint codes.
That is also the downside. Password and second factor in one file is one theft, not two. Some people want the codes on a phone that does not hold the passwords. KeePassXC will not do that split for you. There is no official mobile app. If the database never leaves one computer, the codes never leave it either.
Use it if KeePassXC is already the vault and you accept one basket. keepassxc.org
KeePassXC’s TOTP entries need the clock on the computer to be roughly right. A laptop with a dead CMOS battery will generate the wrong code and you will think the site is broken. Store a couple of the site’s recovery codes on paper, not in the same entry, if losing the database would lock you out of email. Email is how you reset everything else. Protect that one code path like it matters more, because it does.
