The other option is something known as a passkey which is somewhere between a software and hardware token, but with zero-click exploits being used to install spyware on devices around the world, passkeys aren't that much better than text-based multi-factor authentication (that's my opinion, others are free to disagree)