Recovery Codes Explained: How to Store Them Safely

What Recovery Codes Are and Why They Exist

Two-factor authentication (2FA) makes your accounts far harder to break into — but it creates a new problem: what happens when your second factor isn't available? Recovery codes are the answer.

Recovery codes are a set of one-time codes issued when you set up 2FA on an account. Each code works once, letting you sign in without your usual second factor — no app prompt, no text message. Once used, that code is spent.

They exist because second factors fail in everyday life:

• Phones get lost, stolen, or broken
• Authenticator apps get wiped when you switch to a new device
• Phone numbers change, cutting off SMS codes

Without recovery codes, losing your second factor can lock you out of your own account — sometimes permanently. Email providers are the worst case: lose access to your email and password resets for every other account tied to it stop working too.

Typically a service generates 8 to 10 codes at once. Treat them like house keys hidden under separate rocks — each one opens the same door.

One naming note: some services call them backup codes, others say recovery codes, and a few use terms like recovery keys. The wording differs; the idea is identical — a spare set of one-time sign-in codes to keep safe.

One edge case: a few services show codes only once, at setup. If you click through that screen without saving them, there's no way to view them later — you can only generate a new set from your account's security settings.

What Happens If You Don't Save Them

Lose your phone, drop it in a lake, or set up a new device before transferring your authenticator app, and your TOTP codes vanish with it. Restoring a phone from a backup that excluded the app, or simply reinstalling it, can wipe your codes just as completely. Authenticator apps are deliberately designed this way: the keys live on the device alone, so a stolen backup file can't hand someone your codes. The trade-off is that there is no "recover my codes" button. Without recovery codes, the second factor is simply gone.

What follows is rarely pleasant:

• Support-based recovery: You submit identity proof, wait days or weeks, and may still be refused. Some people never regain access.
• Permanent lockout: Some services offer no human recovery path at all. If codes are the only fallback and you skipped saving them, the account is unreachable — email, files, subscriptions, whatever lives behind it.

Lockouts rarely happen at a convenient time. It's usually the moment you urgently need the account: a tax deadline, a job application, family photos. And lockouts cascade. Lose access to your email account and every password reset message sent to it goes with you, which can turn one lost account into several.

Recovery codes exist precisely for this scenario. They're the backup for your backup. Saving them takes two minutes; skipping it can cost an account permanently.

Storing Recovery Codes in a Password Manager

Most password managers — Bitwarden, 1Password, KeePass and similar tools — include a secure notes feature or allow file attachments. Either works well for recovery codes. Create a note, paste the codes in, and name it clearly, for example "Google recovery codes". Use a consistent naming pattern across services, such as "[Service] recovery codes", so a future search finds them every time.

Why this method works well

• Encrypted storage. Your codes are protected by the same encryption as your passwords.
• Searchable. Type the service's name and the codes appear instantly — no digging through drawers.
• Synced across devices. Codes are available on your phone, laptop or tablet.
• Ready for new devices. When you sign in to an account from an unfamiliar device, you may be asked for a 2FA code you cannot generate yet. Recovery codes stored in your manager are right there when you need them.

A few practical details make this method more reliable:

• Save them immediately. Generate the codes, open the manager, paste, save. Waiting until "later" is how codes end up lost.
• Paste, don't retype. Codes are long, mixed strings; manual transcription invites errors that only surface during an emergency sign-in.
• Note the date. If a service lets you regenerate codes later, knowing when you saved the current set tells you whether a stored code is likely stale.
• Mark used codes. When you burn a code, delete it from the note or strike it out, so you never count a spent code as available.

One important caveat

If you forget your master password, you lose everything inside: passwords and recovery codes together. That is why many people keep a written copy as a backstop, covered in the next section.

Offline Storage: Paper and Physical Copies

The simplest offline method is also the oldest: write your codes down or print them, then put the paper somewhere a thief wouldn't casually stumble across — a home safe, a locked drawer, or a fireproof document box.

Why Offline Wins on Security

Paper has one major advantage over every digital option: nothing to hack. A printed sheet can't be leaked in a data breach, can't be phished out of you, and keeps working when your phone dies or your laptop drive fails. If your entire digital life were compromised tomorrow, codes on paper would still be safe.

This matters most for high-value accounts. If someone steals your phone and knows your password, a screenshot of codes in your photo gallery falls with the device. A sheet locked in a safe doesn't travel with anything that can be taken.

The Trade-Offs

Paper's weaknesses are physical:

• Loss or damage — fire, water, and forgetfulness all destroy paper. Keep it dry, away from heat, and consider a second copy in a different location. A page stored only in a drawer that gets thrown out during a cleanup is gone forever.
• Discovery by others — anyone who finds an unlabeled sheet of random codes may realize what they are. Store it discreetly, ideally without the site name in large letters. A neutral heading like "backup codes" with no service name reads as noise to a stranger.
• Household access — family members, roommates, or guests may open the drawer you assumed was private. Choose a spot only you would think to look, or one behind a lock.

Treat the paper like a spare house key: hidden, protected, and never left in plain sight.

What to Avoid

Recovery codes are only as safe as where you put them. A few common mistakes undo all the work 2FA does.

Plaintext and "Convenient" Places

Never store recovery codes in:

• Plain text files on your desktop
• Email drafts or emails to yourself
• Notes apps without encryption
• Cloud drives that aren't protected by strong authentication

Anyone who gains access to your inbox, computer, or cloud account gets a shortcut past your 2FA — exactly what the codes are meant to prevent. Email is the worst offender: inboxes get breached constantly, are linked to password resets for other accounts, and often stay logged in on old devices. A plain text file named codes.txt on your desktop is equally exposed to any malware, a borrowed laptop, or a curious housemate. If you must keep a digital copy outside a password manager, at least put it in a password-protected or encrypted archive, and delete the original.

Screenshots

Don't screenshot codes into your camera roll. Phone photos are often synced automatically to cloud storage, are rarely encrypted, and are easy to expose — through a shared album, a repair technician, or a lost phone. A screenshot feels like saving a copy; it's really publishing one. Some devices also run automatic photo analysis, and backups can outlive the phone itself. If a screenshot is already in your camera roll, delete it, empty the trash, and check your cloud photo library for synced copies.

Sharing Codes When Asking for Help

Never paste recovery codes into support tickets, chat messages, or forums — not even to prove who you are. Legitimate support staff will never ask for them. A code shared in a message can be copied, forwarded, or logged, and it works just like a password. Anyone requesting one is either careless or running a social-engineering attempt; either way, refuse and report it.

Using and Refreshing Recovery Codes

Each Code Works Once

Recovery codes are single-use. Once you sign in with one, it's spent. Keep track: if your codes are on paper, cross out each one as you use it. If they're in a password manager, delete the used entry or mark it clearly. This saves you from the frustrating moment of trying three codes only to realize two were already burned.

A useful habit is recording the count. If you stored ten codes, note that number next to the set. After each use, update it. That way you know exactly how many lifelines remain without counting entries one by one.

When to Regenerate

Generate a fresh set if you suspect exposure — a shared screenshot, a note in a synced folder you no longer trust, a bag that went missing. Also consider regenerating after you've used several, so your remaining supply stays healthy.

One critical detail: regenerating usually invalidates all old codes immediately. Save the new set to your storage location before leaving the settings page, or you could lock yourself out.

Treat regeneration like replacing a spare key: do it while you're signed in and calm, not mid-emergency. If your session expires before you've saved the new codes, you may have no working fallback left.

New Accounts, New Codes

Every time you enable 2FA on a new account, you'll receive new recovery codes. Route them into your existing storage system right away — one consistent habit beats several improvised ones. A code left in a downloads folder or a phone screenshot is a code you'll forget exists, and forgotten codes can't help you during a lockout.

A Simple Storage Routine That Works

A workable setup needs only two copies:

• Primary: recovery codes saved in your password manager as a secure note, next to the account's login entry.
• Backup: a paper copy stored somewhere safe at home — a locked drawer, a fireproof box, or a home safe.

Two copies, two different failure modes covered. The password manager handles everyday convenience; the paper copy survives anything that wipes your devices — a dead phone, a corrupted vault, a forgotten master password.

Make the Paper Copy Findable

Label it clearly with the account name and the date you saved it: "ExampleMail — recovery codes — saved June 2025." Six months later, an unlabeled scrap of paper is useless. The date also tells you whether the codes are still current — if you regenerated codes in September, the June copy is dead and needs replacing.

One caution: don't write the account's password on the same paper. If someone finds it, they get both factors at once. Account name and date only.

Test It Once

A backup you have never tested is a guess. Sign out or use a second device, sign in with a recovery code from your paper copy, confirm it works, then regenerate the codes and update both copies. One test, done. This catches the mistakes you'd otherwise discover during an actual lockout: a smudged digit, a transcription error, a code list you copied before the service issued its final set.

The Wrap-Up

Save codes the moment you enable 2FA, keep two copies, label and date the paper one, test the plan once. That is the entire routine — and it turns a locked-out emergency into a two-minute fix.