Backup codes are the spare key for your two-factor login. Most people skip them during setup, and regret it when a phone dies. This how-to is part of our two-factor login and passkeys guide.
What backup codes are
When you turn on two-factor login, many sites give you a list of eight to ten codes, or sometimes a single recovery key. Each code works once, in place of your usual second factor.
They exist for the moment when your phone is lost, broken or stolen. Our guide on getting back in after losing your phone shows how they fit in.
How to save them
- Turn on 2FA, and look for "backup codes" or "recovery codes".
- Copy them down by hand, or print them on a home printer.
- Label them with the account name.
- Store them somewhere private.
- Test one if the service makes it easy, and then generate a fresh set.
Where to keep them
| Location | Rating | Why |
|---|---|---|
| Paper in a home safe or locked drawer | Good | Offline and easy to reach |
| A sealed envelope with someone you trust | Good | Survives a house fire |
| Password manager | Fair | Convenient, but a single point of failure |
| Notes app on your phone | Poor | Lost along with your phone |
| Email to yourself | Poor | If you are locked out, you cannot read it |
| Photo in your camera roll | Poor | Synced and easy to find |
Common mistakes
- Not saving them at all. You usually see them just once.
- Keeping them on the only device with your authenticator. One lost phone takes out both.
- Not replacing used codes. Once you are running low, generate a new set.
- Forgetting them on your password manager account. That account may be the one you need most. See emergency access and backups.
Treat them like passwords
Anyone with your password and a backup code can log in. Never type one into a site you reached from a link, and never read one to someone over the phone. Scammers ask for these codes too. See fake password reset emails.