Hold to 20:1, no exceptions, that chart changed how I rig everything.

Something a lot of people miss is that the 2FA itself can get phished too. Some fake login pages grab your password and the one time code in real time and then log in as you before it expires. Authenticator apps are way better than SMS but they still fall for that trick. A hardware key like a YubiKey stops that because it checks the actual site address, so it won't hand over your login to a copycat page. That said, going from nothing to an app is a huge jump in safety already, and most people are fine there unless they're a big target.

Man, going from 41 down to 12 is seriously impressive and gives me hope that the rough days really do get fewer over time. Sorry you've been feeling like garbage lately, but the calendar thing sounds way more useful than sitting around wondering if you're actually making progress.