2FAuth

The short version: if you've ever worried about losing your phone and getting locked out of every account behind two-factor authentication, 2FAuth is a free, mature, self-hosted way to fix that single point of failure.

Compared to Google Authenticator or Authy, which tie your codes to a single device (or a vendor's cloud), 2FAuth runs as a web app on infrastructure you control — accessible from any browser, and not dependent on one physical phone surviving. Compared to a password manager's built-in TOTP feature (like Bitwarden or 1Password), 2FAuth is narrower and single-purpose: it only does 2FA codes, which some will see as a plus (smaller attack surface, one job done well) and others as a minus if they'd rather have passwords and codes in one place.

The honest limits: self-hosting means you're responsible for keeping the server patched, backed up, and reachable — if your server goes down, so does access to your codes, which is a different failure mode than a phone-based app. It's also licensed AGPL-3.0, so modifying and redistributing it as a network service carries source-disclosure obligations worth knowing about, though that rarely matters for personal use. For anyone already self-hosting other tools who wants 2FA codes independent of one device, it's a strong, free, well-established pick (4,000+ stars); for someone who just wants the simplest possible setup, a password manager's built-in TOTP support may be less to manage.