I just store them in bitwarden. Wonder what 2FA actually protects against, when any malware will just steal your session tokens anyway.