TOTP is exportable? Google Authenticator and Microsoft Authenticator do not allow TOTP secret key export.

Why would you even look in the direction of either one of those apps when a superior and fully free version exists?

https://f-droid.org/packages/com.beemdevelopment.aegis/

Aegis is fantastic.

That's just how those vendors implemented it. There's nothing stopping you from using the TOTP apps that support the import/export functionality, as it's just strings, no secret sauce.

Just use Aegis on mobile - it allows import/export. And add the TOTPs to a gpg encrypted pass vault on desktop/laptop.

Google Authenticator added exporting a while ago, although it is annoying on some platforms except for the case where you are exporting to another device running Google Authenticator.

That’s because it exports via QR codes containing information for a batch of accounts. On Apple devices you can screenshot that QR code, but I’m told that on Android it disables screenshots so you need another device to save a copy (or you use a photocopier to make a paper copy).

Once you have the QR code, use a QR code reader to extract the data. There is open source software that can turn the batch data from the QR code into individual account data and individual QR codes so you can use them with other TOTP software.

TOTP is also MITMable.

True (ish). But doesn’t solve the same problem as passkeys so this isn’t very relevant.

They are also phishable and man-in-the-middleable. So not a passkey replacement.

Not entirely sure why this is getting downvoted. Passkey is the only non-phishable authentication mechanism that works out-of-the-box on billions of devices. That is huge value from a security perspective.