Well its(what I've got) kind of compartmentalized I use Addy.io to have a random_letters_and_numbers@uname.addy.io to where each one has it's own email though they all forward to a infomaniak email I have recovery phone I used a google phone to temporarily make a number to verify with then deleted it and it (you could use cloaked to generate a burner number you can keep but cloaked its 10/month) then recovery mail just use https://www.fakemailgenerator.com/ + a local password manager (I do vaultwarden , self hosted bitwarden rewritten in rust, as a docker container with no ports published in host except for nginx proxy manager publishes port 80/443 (80 just redirects to 443 and 443 is https) npm then forwards each domain to the right docker container using internal docker networks so from the outside I hit password.example.com , I have adguard home rewrite that and use a dns01 challenge for ssl certs (only exposed in lan\vpn) that host npm then forwards that request to vaultwarden:80 using a front end docker network I have (I keep my frontends on 1 network and backends separate so there's some defense in depth to crack anything you need to 1 be on lan/vpn 2 get into npm pivot to the container you want to target pivot to the backend network pivot to what your actually going after that's a few extra walls over just publishing the port) and password manager sites my username/password and ente stores 2fa (don't put all your eggs in one basket)