I use Google Authenticator.
As Google Authenticator does not offer end-to-end encryption, the data is stored on Google's server in a format that unauthorized users could potentially access, whether through a Google breach or an unscrupulous employee