Two-Factor Authentication Backup Codes: How to Store Them Safely
Most lockouts happen at the worst moment: the phone is lost, broken or stolen, and the code that proves who you are was on that phone. Backup codes are the fix, and they only work if you saved them before the problem.
What backup codes are
When you turn on two-factor authentication, many services give you a short list of single-use codes. Each code works once in place of your normal second step. They exist for the day your phone or authenticator app is not available.
Where to keep them
- Password manager: in a secure note, protected by a strong master password.
- Printed copy: in a safe place at home, away from the device itself.
- Encrypted file: on a drive that is not the same phone or computer you log in with.
Where not to keep them
- In your email inbox without extra protection.
- In a screenshot in your phone gallery that syncs everywhere.
- In a chat with yourself on the same phone that you may lose.
A simple routine
- When you enable two-factor for an account, download the backup codes immediately.
- Save them in your chosen place and write down which account they belong to.
- Test that you can find them without your phone.
- After you use a code, cross it off.
- If you generate a new list, destroy the old one, because the old codes stop working.
Which accounts need them most
- Your main email account, since it resets everything else.
- Banking and payment apps.
- Cloud storage and password managers.
- Any account that holds a business or customers.
Phone numbers and backup methods
If the second step is an SMS code, a lost number is a lost key. Prefer an authenticator app and keep backup codes. For low-value accounts that you only need for a short time, a one-time virtual number is a reasonable choice, but remember that you will not be able to receive codes on it later, so keep the account disposable.
What a good recovery plan has
- A password manager with a strong master password.
- Backup codes printed or saved offline.
- A second authenticator device or a hardware key for the main email.
- A trusted contact or documented recovery steps for business accounts.
Mistakes that cause lockouts
- Replacing a phone before moving the authenticator.
- Turning on two-factor and skipping the backup codes.
- Saving codes on the same device as the authenticator.
- Forgetting that a changed number breaks SMS recovery.
Questions people ask
Are backup codes safe to print?
Yes, if you keep the paper somewhere private, because each code works only once.
What if I lose the codes and the phone?
Use the service's account recovery process, which can take days and may need proof of identity.
Related guides and pages
Create a free OtpGet account and try it with a small balance.