Store Two-Factor Recovery Codes Properly

Two-factor authentication is designed to stop someone with your password. The same design stops you when the phone with the authenticator is lost, wiped, or left in a taxi. Recovery codes are the mechanism that keeps a security feature from becoming a lockout, and they only work if they were stored before the emergency.

Find the codes before you need them

Most services generate recovery codes in the same security settings page where two-factor is enabled. They are usually eight to ten single-use strings, meant to replace the authenticator prompt when it is unavailable. Download or copy them at enrolment; some services let you regenerate them later, and some show them only once.

Label the file with the service name and the date. A folder of codes with no context is nearly useless six months later, when you cannot remember which set belongs to which account.

Store them offline, in two places

Keep the codes out of the account they protect. A screenshot in the phone's photo library is not a backup, because the phone is one of the things that can disappear. Print the list, or write it on paper, and store it where you keep important documents. A second copy at a different address covers fire, flood, and theft.

Paper is unglamorous and that is the point: it cannot be encrypted by ransomware or synced to a compromised account. If you prefer a digital copy, put it in an encrypted archive on a drive that is not the computer you use daily, and accept that you must test the password for that archive.

Understand what a code replaces

A recovery code usually bypasses the second factor, not the password. An attacker who finds the sheet still needs your password to use it, which is why the sheet must be stored as carefully as a bank document. Each code works once; mark it used and cross it off.

If a code is used, regenerate the set. Some services invalidate all remaining codes automatically, and others do not. After a recovery event, review the account's active sessions and remove devices you do not recognise.

Plan for the lost phone, not just the lost code

Codes are one layer. A second authenticator app on a tablet, a hardware security key kept at home, and a printed sheet in a second location give you three ways back in. The CISA multi-factor guidance at cisa.gov explains which factors resist phishing and which are easier to recover.

For the accounts that can reset others, such as email and the password manager itself, test the recovery path on a calm day. Sign out on one device, use a code to sign back in, and confirm that the remaining codes still work. A plan that has never been tried is a hope.

The storage checklist

• Codes downloaded at enrolment, not requested during an emergency.
• Printed or written, labelled with service and date.
• One copy at home, one at a separate trusted location.
• Not stored in the account they protect or in a camera roll.
• Used codes marked and the set regenerated after recovery.
• Backup factor available, such as a second app or hardware key.

The password manager is the natural place for a daily copy, as long as a paper copy exists outside it. Our guide on setting up a password manager puts both in the same week.

What to do if the codes are already lost

Start the provider's account recovery process immediately and be ready to prove ownership with billing details, device history, or identity documents. Contact the provider from a trusted network, change the password from a clean device, and enable a new factor once access is restored. The lesson is not to trust a single recovery route again.