digital

How to Back Up Two-Factor Codes So Nobody Gets Locked Out

By Jason Su · Updated September 18, 2026

Turn two-factor authentication on everywhere it is offered — then immediately save the way back in. Every service that offers two-factor also gives you a recovery path: a list of backup codes, a recovery key, or a second method you can use. Save those codes, print them, and store them wherever your trusted contact can reach them. Without that step, the protection you added becomes the lock that keeps your own family out.

Why this matters more than people expect

Two-factor authentication is one of the few security changes that genuinely works. It stops most account takeovers, because a stolen password alone is no longer enough.

It also creates a new failure mode, and it is the one almost nobody plans for. Your second factor usually lives on a device — a phone with an authenticator app, a laptop, a hardware key. That device can be lost, replaced, dropped in water, or simply out of reach. For you, that is an inconvenience. For the person trying to settle your affairs, it is a wall.

So the question is not whether to use two-factor. It is where the way around it lives.

The main kinds of second factor

Type	How it works	What happens if the device is gone
Authenticator app	Generates a rotating code on your phone	You need the backup codes, or the app’s own export or backup feature
Text message	A code is sent to your phone number	You need the phone number to keep working, which is often the problem
Hardware key	A small physical device you plug in or tap	You need the key itself, and often a second key registered as a backup
Email or a second address	A code goes to another inbox	You need access to that inbox — which is why email is the account to protect first

The important thing to notice: every one of these depends on something physical continuing to exist. That is precisely why the backup codes exist, and why they are the part people skip.

Where to find your backup codes

Every service does this slightly differently, so use the provider’s own help pages rather than a screenshot — menus move, and a guide written last year may point at a button that has been renamed.

The pattern to look for in your account settings:

• Two-factor or security in your account settings
• Backup codes, recovery codes, or recovery key
• Add another method — a second phone number or a second key

When you find them, generate them even if you think you already have some. Old codes are often invalidated the moment new ones are created.

How to store them

The rule is simple: backup codes go where the passwords do not.

• Print them. Paper does not need a password, a battery, or an internet connection. This is the part people resist, and it is the part that works.
• Put the paper somewhere physically protected — the same place you keep other documents that matter. See where to store important documents.
• Keep a second copy somewhere else. A single sheet in a single house has a single point of failure.
• Tell your trusted contact that the sheet exists and where it is — without texting a photo of it to anyone. See how to leave digital passwords to family for the conversation and the setup this fits into.
• Record the location on your Password Log Sheet, which is designed for where things are rather than what they are.

Some password managers can also store your backup codes as a secure note. That is a reasonable extra, but it cannot be the only copy — because the vault itself may need a two-factor code to open.

Email first, then everything else

If you are going to do this in stages, do it in this order:

1. Email. It resets everything else, and it is usually the account your other recovery methods point at.
2. Banking and payment apps. Anything that can move money.
3. Cloud storage with photos.
4. Your password manager itself. Check whether it has two-factor, and make sure the recovery path for the vault is printed and stored.

That last one surprises people. If your vault requires a second factor and that factor is only on your phone, then losing the phone locks the vault — even for you.

What not to do

• Do not leave the backup codes in the app that generates your codes. If the phone is gone, so are both halves.
• Do not photograph them and leave the photo in your camera roll. Anyone with the phone has the codes, and a phone is a device that gets handed around.
• Do not store them only in your password manager. See above: the vault may need a code you cannot reach.
• Do not rely on text-message codes alone. They depend on a phone number staying active, which is one of the first problems families hit.
• Do not generate codes and then never check they work. Log the codes somewhere you will find them again — a note in your calendar to reprint them once a year is enough.
• Do not assume one code will cover everything. Backup codes are usually tied to a single service. You need a set for each account that matters.

Frequently asked

How many backup codes should I have?

However many the service gives you — often ten. You do not need to print them all; you need at least two usable ones stored in different places. Keep the rest somewhere secure in case a copy is lost.

Do backup codes expire?

Some do, some do not, and there is no standard. Check your provider’s own page. The practical approach is to reprint them once a year, which also catches the case where old codes were invalidated when you generated new ones.

Is it safe to print them?

Yes — safer than most of the alternatives. The realistic threat to your accounts is a stolen password used remotely, not someone physically searching your house. A printed sheet in a protected place is a very good trade.

What if I lose both my phone and my backup codes?

Then you rely on the provider’s account recovery process, which may take days and may not succeed. This is the situation the whole page is designed to prevent.

Should I use a hardware key?

They are excellent, and if you use one, register a second key as a backup and keep it somewhere else. A single hardware key with no spare is a single point of failure that is easy to lose and impossible to replace quickly.

Do I need to tell anyone where the codes are?

Yes — one person. Codes nobody can find are the same problem as no codes, just with more steps.

Next step

Pick your email account and generate its backup codes today. Print them, put them where you keep important documents, and tell one person that sheet exists.

Then add the location to your Password Log Sheet and record it using the free Checklist Builder — so the security you added does not become the thing that locks your family out.

This is general information, not legal or financial advice. Recovery processes and account policies vary by provider and change frequently — please confirm details on the provider’s own help pages and talk with a licensed professional about your situation.