The phone slips out of a jacket pocket and cracks on the pavement. Screen dead, nothing responds. And every two-factor code you rely on to log in lived on that phone.
This is the moment backup codes were made for. They are the quiet safety net that turns “I am locked out of my entire life” into “give me two minutes.” Almost nobody sets them up in advance, and almost everybody wishes they had.
Key takeaways
- Backup codes are one-time codes that log you in when your phone or authenticator is gone.
- Generate them when you turn on two-factor authentication, not after you are already locked out.
- Store them somewhere offline and separate from your phone, like a printout or a password manager.
- Each code works once, so cross them off as you use them and regenerate when they run low.
What backup codes actually are
When you turn on two-factor authentication, most services offer a set of backup codes, usually eight or ten short strings of numbers. Each one is a single-use skeleton key for that one account.
If your normal second step is unavailable, because your phone is lost, dead, or wiped, you type in one of these codes instead. The account lets you in, marks that code as used, and moves on. It is that simple.
These codes sit at the heart of any solid two-factor setup, which is why we mention them throughout our guide to setting up two-factor authentication step by step. Turning on 2FA without saving the backup codes is like installing a great lock and losing the spare key.
Where to find them on your accounts
Every major service tucks backup codes into its security settings, often right next to the 2FA setup. Here is where to look on a few common accounts.
| Account | Where the codes live |
|---|---|
| Security, then 2-Step Verification, then Backup codes. | |
| Apple ID | Recovery uses a recovery key and trusted devices rather than printed codes. |
| Microsoft | Security, then Advanced security options, then Recovery code. |
| Most others | Look under Security or Two-Factor Authentication for “backup” or “recovery” codes. |
Generate a set for each of your most important accounts now, while everything is working. The best time to make a spare key is before you need it.
Where to store them so they are safe and findable
Backup codes create a small puzzle. They need to be somewhere you can reach when your phone is gone, but not somewhere a thief or snoop can grab. Here is how I balance that.
The printout method
Print the codes and put the paper somewhere secure at home, like a drawer where you keep important documents or a small safe. Paper cannot be hacked and does not need a battery. The one rule: do not tape it to your laptop or leave it in your wallet next to the device it protects.
Store the codes physically away from your phone. If a thief steals your bag with both your phone and your backup codes inside, they have everything. Separation is what makes the codes a real safety net.
The password manager method
You can also save backup codes as a secure note inside your password manager. This keeps them handy across devices and encrypted at rest. It works well for most accounts, with one important exception.
Do not store your password manager’s own backup codes inside that same password manager. If you get locked out of the manager, those codes are locked away with everything else. Keep the manager’s recovery codes on paper, separately.
How to use a code when the moment comes
When you try to log in and cannot complete the normal second step, look for a link that says something like “Try another way” or “Use a backup code.” Click it, type one of your saved codes, and you are in.
Cross that code off your list, because it will not work a second time. If you are down to your last one or two, generate a fresh set right away, which automatically retires the old ones.
The first time I used a backup code, I was standing in an airport with a phone that had just died, trying to reach my email. Ninety seconds and one code later, I was logged in on a borrowed laptop. That is the whole point of setting them up early.
Backup codes are not your only lifeline
Codes are the simplest recovery method, but a couple of others are worth knowing about so you are never relying on a single fallback.
An authenticator app on a second device, like a spare tablet, gives you a working code source if your main phone dies. This is one reason we generally favor authenticator apps over text message codes, since apps can be set up in more than one place.
Some accounts also let you name a trusted recovery contact or keep a longer recovery key. Layering two of these methods means one lost item never locks you out. All of this ladders up to the broader habits in our overview of password security basics.
The United States Cybersecurity and Infrastructure Security Agency explains multi-factor authentication and recovery in plain terms at cisa.gov.
Your afternoon checklist
- List your most important accounts: email, bank, password manager, and main social media.
- For each one, open the security settings and generate a set of backup codes.
- Print the codes or save them as a secure note, kept away from your phone.
- Store your password manager’s own recovery codes on paper, never inside the manager.
- Label each code sheet clearly so you know which account it belongs to.
- Set up an authenticator app on a second device where you can, as an extra fallback.
- Do a dry run: log out of one account and log back in using a backup code.
- Regenerate any set you dip into, so you never run out unexpectedly.
Nobody plans to drop their phone in a lake, but phones die at the worst possible times. Spend twenty minutes saving your backup codes today, and the day it happens becomes a shrug instead of a crisis.
