How to store backup codes safely

Guide · 2FA backup code storage

A recovery code is powerful precisely because it can bypass your second factor. Anyone holding your backup codes can get into your account without your phone. So storage has two jobs that pull in opposite directions: the codes must be reachable when your normal sign-in path fails, and unreachable to everyone else. Every good storage method below satisfies both.

The golden rule: separate from the 2FA device

Whatever method you pick, your backup codes must live somewhere that does not disappear in the same failure as your authenticator. If your codes are in a note on your phone and your phone is lost, stolen or factory-reset, your "backup" is gone at the exact moment you need it. Storage should be on a different device, on paper, or both.

Good option 1: a printed physical copy

For most people, this is the simplest robust method. Print the list (or write it down by hand), and keep the paper somewhere physically secure:

• A locked filing cabinet or drawer at home, alongside other important documents.
• A fireproof safe for protection against more than theft.
• A bank safe deposit box for your most critical accounts.

Paper is immune to hacking, phishing and dead batteries. Two habits make it work: label each set with the service name and date ("GitHub backup codes, Oct 2026"), and cross off each code with a pen the moment you use it, since every code is single-use.

Good option 2: a reputable password manager

Most password managers (1Password, Bitwarden and similar) offer secure notes — encrypted entries separate from your logins. Create one note per service, paste the codes in, and label it clearly.

• Pros: encrypted, searchable, reachable from any device where you can open your vault — including a borrowed computer in an emergency.
• Watch out: make sure you can actually open your vault without your phone. If your password manager itself requires your phone's authenticator to unlock, a lost phone locks you out of both the codes and the vault. Keep a recovery path for the vault itself — many managers provide an emergency kit or recovery code of their own, which itself belongs on paper.

Good option 3: an encrypted offline drive

For the technically comfortable: save the codes to a plain text file on a USB drive, encrypt the whole drive (BitLocker on Windows, FileVault on macOS, or LUKS on Linux), and store the drive somewhere safe and separate from your computer. The encryption password must be memorized or stored on paper — if you forget it, the codes are gone permanently.

Even better: combine two methods

One copy is a single point of failure. A sensible setup is paper at home plus an encrypted digital copy elsewhere — for example, a printed sheet in a safe and a secure note in your password manager. If one copy is lost, damaged or unreachable, the other covers you. Just remember that each copy is equally powerful, so protect both with the same seriousness.

Places you should never store backup codes

The worst storage spots are the most convenient ones. They share one flaw: they either vanish in the same failure as your phone, or they are far too easy for someone else to reach.

• A screenshot in your photo gallery — synced to the cloud, backed up everywhere, and visible to any app with photo access.
• An unencrypted note on your phone — gone with the phone, readable by anyone who picks it up.
• An email to yourself — especially in the same account the codes are meant to recover. That is locking your spare key inside the house.
• A chat message to yourself in a messaging app — cloud-synced, searchable, and one compromised session away from exposure.
• An unlabeled scrap of paper in a random drawer — an unusable backup is barely better than no backup. Label everything.

When to refresh your stored codes

Stored codes are not "set and forget". Regenerate and re-store the set when any of these happen:

• You used one or more codes — the set is now partially spent.
• You suspect exposure — someone saw the paper, or the file may have been copied.
• You changed devices or re-enrolled 2FA — many services issue new codes automatically at that point; store the new list and destroy the old one.

When you replace a set, destroy the old copy (shred paper, delete the file) so a stale list cannot confuse you — or anyone else — later.