Where should I keep my backup and recovery codes?

Everyone is told to enable two-factor authentication. Far fewer are told what happens when the phone is dropped down a drain, and that is the moment recovery codes exist for.

Step by step

1. Collect them when you set up each account.Every service that offers two-factor authentication offers recovery or backup codes at setup, usually as a list of eight or ten one-time codes. Most people skip past this screen.
2. Go back for the accounts you set up years ago.Look in the security settings of email, banking, cloud storage and any account holding money. Generating a new set invalidates the old one, which is fine if you no longer have it.
3. Print or write them down.Paper is genuinely the right medium here: it does not depend on a device, a password or a battery. Write the service name next to each set.
4. Keep the primary copy somewhere sensible at home.With passports and certificates, or in a small fireproof document bag. Not stuck to the computer, and not in a folder labelled 'passwords' in the office drawer.
5. Keep a second copy elsewhere.A relative's house, a safe deposit arrangement, or a sealed envelope with a trusted person. This is what covers a fire or a burglary that takes the whole folder.
6. If you keep a digital copy, keep it encrypted.A password manager entry is a reasonable place, as long as the manager's own recovery is on paper. A plain note in email or a photo in your photo library is not.
7. Cross them off as you use them.They are one-time codes. Once you are back in, regenerate the set and replace the paper — the old ones are spent.
8. Add a second factor as well as codes.A second authenticator device, a hardware key kept in the drawer, or a trusted contact where the service supports it. Codes are the last resort, not the only one.

Tips

• Tell one other person in the household where the folder is. Recovery codes nobody can find are the same as no recovery codes.
• Email is the account to protect hardest — it is the reset route for almost everything else, so its recovery codes matter most.
• When you replace a phone, check the accounts still work before wiping the old one. That is the moment when a missing recovery code is discovered.

Common mistakes

• Screenshotting the codes into the photo library — The library syncs to the cloud account those very codes protect, so losing access to that account loses the codes with it — and anyone who reaches the library reaches the codes.
• Storing them only in the password manager whose own recovery is unrecorded — It creates a circle: the manager needs its recovery key, the recovery key is in the manager. One item must exist outside the system, on paper.

If it doesn't work

Questions people ask