I‘ve been using unique passwords and totp for some time but I get uneasy whenever I use my phone as a mfa. The reason is the worry about losing it and potentially getting locked out of my accounts.

Searching for best practices didnt help so far. Thats why I turn to you.

So far I have my password vault and my phone with an authenticator app. I may have stored two backup codes somewhere but I wouldnt find them, ever. Especially not in panic mode.

Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right? Or only if I configured the mfa to ask for a pin while the passwords ask for biometrics or something.

If I did this I‘d still lose everything if the vault got lost but thats what backups are for. This solution does not include the mfa (or backup key) to my vault though.

Ideally, I would put it in an actual vault but so the single point of failure probabilities keep increasing.

Any pros here that solve these binds regularly? Whats the best practice? Is there a 3-2-1-backup equivalent?

Edit: btw here is what I found. The encrypted text on paper idea is pretty good but seems very complex. https://security.stackexchange.com/questions/76464/best-practices-for-usefully-storing-two-factor-authentication-backup-codes