How to store your recovery codes safely

Nearly every service gives you a set of backup or recovery codes when you switch 2FA on. They're single-use passwords that work when your authenticator doesn't — and most people never save them.

Store them well

• Keep them somewhere separate from your phone — a printed copy or an encrypted file.
• Don't store them as a plain note or a screenshot in your photo library.
• Save them for your most important accounts first: email, then anything with money attached.
• Cross a code off once you use it — each one works only once.
• Regenerate the set if you think it's been seen by anyone else.

Why they matter more than you think

A backup of your authenticator protects you if you replace a phone in an orderly way. Recovery codes protect you when things go wrong — a lost device, a failed restore, or an account you set up before you turned backup on.