How to Safely Store Your 2FA Recovery Codes

Two-factor authentication (2FA) is one of the most effective ways to protect your online accounts. But if you set up 2FA without properly storing your recovery codes, losing your phone or resetting your authenticator app could lock you out of your accounts permanently.

This guide explains what 2FA recovery codes are, why they matter, and how to store them safely -- including how to share them with someone you trust for emergencies.

What Are 2FA and Recovery Codes?

Two-Factor Authentication (2FA)

A password alone cannot fully protect your account. If your password is compromised, anyone can sign in. 2FA adds a second verification step beyond your password.

• Authenticator apps -- 6-digit codes generated by Google Authenticator, Authy, etc.
• SMS verification -- Codes sent to your phone via text message
• Hardware keys -- Physical security keys like YubiKey

Recovery (Backup) Codes

Recovery codes are one-time emergency codes provided by a service when you first enable 2FA. They are your only way to access your account when your authenticator app or phone is unavailable.

Typically, you receive 8 to 10 codes, each usable only once.

What Happens If You Lose Your Recovery Codes?

Situation	With Recovery Codes	Without Recovery Codes
Phone lost	Log in with recovery code, reset 2FA	Account locked
Authenticator app deleted	Log in with recovery code, reconfigure	Account locked
Device change	Authenticate on new device with code	Support ticket (days to weeks)
Phone number changed	Log in with recovery code, update number	Account locked or delayed

In the worst case, you permanently lose access to your email, cloud storage, financial accounts, and more. Some services take weeks for identity verification, and others offer no recovery at all.

Dangerous Storage Methods

Screenshots in Your Photo Gallery

Photo galleries sync to the cloud and are accessible across multiple devices. If a device is lost or the cloud account is compromised, your recovery codes are exposed.

Plain Text in a Notes App

Most default notes apps are unencrypted. Anyone who can unlock your device can see the codes.

Saved in an Email Draft

If your email account is hacked, your recovery codes are compromised too. Storing the recovery codes for your email account inside that same email account is a logical contradiction.

Unencrypted Text Files

Plain text files on your computer can be read by malware or anyone with unauthorized access to your device.

Safe Storage Methods

Method 1: Written on Paper, Stored in a Safe

The most traditional approach, but still effective. Paper is immune to digital hacking. Store it in a fireproof safe or a locked drawer.

Precautions:

• Use a waterproof envelope for fire and flood protection
• Keep it in a safe or locked container
• Do not make photocopies

Method 2: Encrypted Password Manager

Use the secure notes feature of a password manager like 1Password or Bitwarden. Your codes are protected by the master password and strong encryption.

Precautions:

• Prepare a separate recovery method for the password manager itself
• Keep your master password secure

Method 3: Password-Protected Memo Shared with a Trusted Person

For situations where you cannot access your own recovery codes during an emergency, you can securely transfer them to a family member or trusted person in advance.

How to Share Recovery Codes Securely with LOCK.PUB

When sending recovery codes to a family member or trusted person, using messaging apps or email leaves the codes permanently in conversation history. LOCK.PUB's secret memos provide a more secure alternative.

Usage Scenarios

Scenario 1: Sharing emergency recovery codes with a spouse

1. Create a secret memo on LOCK.PUB and enter your recovery codes
2. Set a generous expiration time (e.g., 30 days)
3. Send the memo link to your spouse
4. Share the password through a separate channel
5. After they view it, instruct them to write the codes down and store them in a safe

Scenario 2: Sharing business account recovery codes with a team

1. Create a secret memo with the recovery codes for critical business accounts
2. Transfer it securely to the IT administrator
3. After verification, the admin saves the codes in a password manager

When to Regenerate Your Recovery Codes

• You have used even one of your recovery codes
• You suspect your storage method has been compromised
• You have lost or had a device stolen
• Your relationship with someone you shared codes with has changed

Most services allow you to invalidate existing recovery codes and generate new ones from your account security settings.

Major Services That Support 2FA Recovery Codes

Service	2FA Methods	Recovery Codes	Where to Find
Google	App/SMS/Key	Yes (10)	Account Settings > Security > 2-Step Verification
Apple	App/SMS	Yes	Apple ID Settings > Security
GitHub	App/SMS/Key	Yes (16)	Settings > Password and authentication
Microsoft	App/SMS	Yes	Security Settings > Two-step verification
Twitter/X	App/SMS	Yes (1)	Settings > Security > Two-factor authentication
Instagram	App/SMS	Yes (5)	Settings > Security > Two-factor authentication

Get Started Now

2FA recovery codes are the safety net of your digital life. Check your recovery codes for every service you use right now, and store them securely. If you need to share emergency access with someone you trust, use a password-protected memo.

Create a secret memo on LOCK.PUB to share your recovery codes safely.

Create a Secret Memo