Where to Keep Two-Factor Recovery Codes Without Losing Them

Backup codes only help if you can find them later, and that turns out to be the harder half of the job.

I saved a set once, and when I went looking for it I could not tell which note, which email, or which photo it had landed in, so the codes were not gone, they were unfindable, which is the same problem on the day you need them.

A backup or recovery code is a spare way into an account when your usual second sign-in step is unavailable, if that account offers codes, and it is not your password or the everyday code your authenticator app generates, but if the list lives only in a screenshot, a downloads folder, or a tab you meant to print, the saving got done and the finding never got a turn.

Write down where they live, not a second copy of every code

The useful record is a finder, which means the account name, which email recovers it, the date you last checked, where the codes actually are, and what you will do if the phone that makes the everyday codes is lost.

That is enough to open the right drawer on a bad day, and it is not a second copy of the codes themselves and should not sit on the same page as the passwords, because if someone finds a page that has both they have the login and the spare key.

If you do write the codes out, put them on a separate private page and keep that page somewhere only you and one trusted person can reach, because a photo of the codes in the camera roll is still on the phone you are trying not to depend on.

What to fill in first

Start with the account that would lock the others, which is usually email, and leave the streaming logins for later.

Open the account’s security page while you still can and look for backup codes, recovery codes, or a line that says you already generated them, and if the account will show the list again confirm it matches what you saved, but if making a new list turns the old one off, which is what Google does with its set of 10 single-use codes, hold off on a fresh set until you are ready to store it before you close the page.

Then write four things:

• the account or app
• the recovery email
• the date you checked
• where the codes live, in words a tired person can follow, like "envelope in the fire box" or "printed page in the desk folder, not the password notebook"

Add one line for what to do if that phone is lost, and "Use an unused backup code and mark it as used, and if you generate a new set, replace the stored copy too" is a useful instruction rather than a link you will not remember.

One account is a finished job, and six is a full page, not a requirement for today.

Where the page itself should live

Paper in a private place beats a note inside the same phone, and a folder in a drawer you already open, a fire box, or a labeled envelope is enough, as long as you keep it away from the computer and out of the back of the password notebook for the same accounts.

Tell one person that the page exists and where it is, and they do not need the codes, they only need to know which drawer, because the point of a finder is that someone can find it when you are not the one looking.

What this page does not do

It does not turn on two-factor authentication or walk you through an authenticator app, it does not replace a password manager, and it is not a crypto seed-phrase log, and it also does not get you back into an account that is already locked, so if the phone is gone and you need the steps for that day, that is a different job of one account at a time, a second way in if you made one, and then that account’s own recovery.

The page is the record of where the spare keys are, which means it is not the spare keys and it is not the locksmith.

The small step

Find the one set of codes you already saved, or check whether your email account offers backup codes if you never saved them, and then store the codes somewhere private that you can reach without the phone, write where they live, and date the line.

That is the version you can keep, just the one set, and a full inventory of every login can wait.

A sheet that remembers the drawer

The Household Recovery Codes Sheet is the page this article describes, with six account blocks that each hold the account or app, the recovery email, the date checked, where the backup codes live, and what to do if that phone is lost, and you get US Letter and A4 plus a short instructions page.

It is a location sheet and not a password tracker, and it does not store the codes for you, so if you write the codes themselves, use a separate private page and do not keep that page next to the password list.

Get the Household Recovery Codes Sheet on Etsy