Honestly, the safest for me has always been the boring one: Microsoft authenticator