2FA backup codes: what they are and how to store them

When you enable two-factor authentication, most services hand you a list of backup codes (sometimes called recovery codes). They're easy to ignore in the moment — and the one thing that saves you if your phone is ever lost.

What backup codes are

Each backup code is a one-time password you can use instead of an authenticator code. If you can't reach your authenticator app, a backup code gets you in. Once used, that code is spent.

Where to store them

Treat backup codes like a spare key:

• A password manager — the simplest safe option for most people.
• Printed and kept somewhere physical — a drawer or safe, away from your computer.
• Not in a plain note on the same phone that has your authenticator app — if you lose the phone, you lose both.

When you'll be glad you have them

• Your phone is lost, stolen, or wiped.
• You're switching to a new device.
• You're travelling without signal.

For more, read how to recover your 2FA accounts, then set up 2FA on your accounts — and save those codes this time.