Recovery
How to store 2FA backup codes without creating a new risk
Build a recovery plan that survives a lost phone while keeping single-use backup codes away from account attackers.
Backup codes bypass your normal second factor
Most services provide a small set of single-use recovery codes when you enable two-factor authentication. A valid backup code can replace the code from your phone or security key. That makes it extremely useful during a device loss—and extremely valuable to an attacker.
Download or copy the codes only on a device you trust. Do not leave the original download in a shared Downloads folder, an unencrypted note, a chat thread, or an email draft.
Choose two independent recovery locations
A practical setup keeps an encrypted digital copy and a physically separate offline copy. For example, store one copy in a reputable password manager and another printed copy in a secure location. The second copy should not travel with the phone that contains your authenticator.
Label the codes clearly enough that you can identify the service later, but do not add unnecessary account details to a paper copy. Anyone who finds it should not receive a complete map of your login.
- Never photograph recovery codes into an automatically synced photo library.
- Do not store codes beside an unencrypted password list.
- Regenerate the entire set after using a code if the service offers that option.
- Review your recovery plan whenever you replace your primary phone.
Test recovery before there is an emergency
Confirm that you know where the codes are and that the service still recognises the recovery method. You do not need to consume a code simply to inspect the sign-in flow, but you should understand which account details and devices will be required.
Recovery email addresses and phone numbers also deserve regular review. Remove old numbers, secure the recovery inbox with strong authentication, and avoid making one weak account the recovery key for every other account.