Starter · Level 1 of 3
A two-factor authentication (2FA) backup code is a one-time-use recovery key that gets you back into an account when your usual 2FA method (a text message, an authenticator app, a physical key) is not available. Every major service that offers 2FA hands you a batch of these codes the moment you turn it on, and most people click past that screen without saving anything. That is the actual gap: 2FA protects an account from a stolen password, but only a saved backup code protects it from a lost phone. Save the codes the moment you see them, and losing a device turns from a lockout into a minor inconvenience.
2FA works by requiring something beyond a password, usually a code from an app or a text message, before a login completes. It is one of the single most effective steps available for protecting an account, which is exactly why it is worth pairing with a backup plan rather than skipping that part of the setup.
What actually happens if you lose your phone with no backup codes saved?
Most 2FA setups tie the second factor to one physical device: an authenticator app on a phone, a text message sent to a phone number, or a hardware key kept on a keyring. Lose that device, and the login screen still asks for a code it can no longer generate. Without a saved backup code, the only way back in is each service’s own account-recovery process, and those processes are built to be slow on purpose — a fast recovery path is also a fast path for an attacker pretending to be you.
The trigger is rarely dramatic. A phone gets left in a taxi, a screen cracks beyond repair, a device gets wiped and set up fresh without first transferring the authenticator app, or a phone number gets ported to a new carrier without the old SIM. Any of those, on its own, is routine. Paired with no saved backup codes, any of them can turn into days of being locked out of email, a bank account, or a work tool while a recovery request works its way through review.
GitHub, for example, has a dedicated account-recovery request form for exactly this situation, and it can take real time to review because the reviewer has to confirm the request actually comes from the account owner. Google’s recovery flow works similarly: a series of identity checks that may or may not succeed depending on how much account history is available to verify against. Some services will not restore access at all if none of the recovery signals line up. A saved backup code skips all of that. It is the one credential built specifically for this moment.
The stakes rise fast when the locked-out account is not a hobby login but a primary email, a bank, or the single tool a small business runs on. Losing access to the account that resets every other password is the worst version of this problem, which is exactly why it deserves the five minutes now rather than the recovery process later.
Where should you actually store backup codes?
Two storage options come up again and again, and each has a real tradeoff worth knowing before you pick one.
| Storage option | Best for | Watch out for |
|---|---|---|
| Password manager secure note | Everyday accounts you might need to recover quickly, from any device | The password manager itself becomes the single point of failure: losing access to it with no recovery plan takes every saved code down with it |
| Printed or handwritten offline copy | High-value accounts: primary email, the password manager’s own account, banking | Physical loss (fire, flood, a drawer someone else can open) and no searchability if you’re storing codes for a dozen accounts |
For most accounts, a secure note (or file attachment) inside a password manager is the sensible default: it travels with every other credential, benefits from the same encryption, and is searchable when you need one specific code among many. Reserve a printed or handwritten copy, kept somewhere offline like a home safe or a locked drawer, for the small handful of accounts where losing the password manager itself would be a genuine problem, the password manager’s own account chief among them. That last point solves a real chicken-and-egg risk: if every backup code lives only inside the password manager, losing access to the password manager takes every one of them down at once. One offline copy for the accounts that matter most closes that gap.
How do you save your backup codes the moment you turn on 2FA?
Here is the exact sequence on GitHub, one of the more common accounts to protect with 2FA, and the same pattern applies almost everywhere else, just under a different settings menu.
- Click your profile picture in the top-right corner of any GitHub page, then click Settings.
- In the sidebar under Access, click Password and authentication.
- Under Two-factor authentication, set up an authenticator app as the primary method.
- On the recovery codes screen that follows, click Download to save a text file, or Print for a hard copy. GitHub issues sixteen one-time codes; each works once, and using all sixteen requires generating a fresh set.
- Open the password manager, create a secure note titled something identifiable like “GitHub 2FA recovery codes,” and paste the codes in.
- Delete the downloaded text file from the Downloads folder once the codes are safely stored elsewhere — a plaintext file sitting on the device defeats the point of moving it into an encrypted note.
- For an account where losing password-manager access would be a real problem, also print a copy and store it offline.
The same pattern (enable 2FA, find the recovery codes screen, save immediately, delete any loose plaintext copy) applies to Google, most banks, and any other service built on standard 2FA recovery codes. The screen names and menu paths differ slightly from one service to the next; the codes themselves and the five-minute habit around them do not.
What do you do if you are already locked out with no codes saved?
Start with any secondary recovery method already on file: a backup email address, a secondary phone number, or a second registered authenticator device. Many services check for one of these automatically once the primary 2FA method fails, and having even one already registered can turn a multi-day recovery into a same-day one.
If none of those exist, the fallback is each service’s manual account-recovery process, and it is worth going in with realistic expectations: identity verification steps, a wait measured in days rather than minutes, and in some cases a service that cannot restore the account at all if too little recovery information was ever on file. Some services ask for a government-issued photo ID; others rely on a trusted secondary email plus a waiting period designed to block impersonation attempts. This is the actual cost of skipping backup codes: not a hypothetical inconvenience, but real days of lost access to email, banking, or a business tool, with no guaranteed outcome at the end of it.
Once access is restored, generate a fresh set of backup codes immediately and store them properly this time, rather than repeating the same gap a second time.
What common mistakes leave people without a working backup code?
- Screenshotting the codes and leaving the image in the camera roll. Readable by anyone who unlocks the phone, synced automatically to a cloud photo backup in many setups, and useless in exactly the scenario the codes exist to solve: a lost or broken phone.
- Pasting them into a plain, unencrypted notes app. No meaningful protection if the device or the cloud account behind that app is ever compromised, and no protection at all if the notes app itself is the thing that syncs to the lost device.
- Emailing the codes to yourself. The inbox is frequently protected by the very same 2FA, so it does not help during an actual lockout, and it leaves a permanent plaintext copy sitting in a searchable message history indefinitely.
Quick-reference checklist
- The moment 2FA is enabled, look for the backup or recovery codes screen. Do not skip past it.
- Download or copy the codes immediately.
- Store them in a password manager secure note as the default option.
- For high-value accounts, also keep a printed or handwritten copy somewhere offline.
- Delete any temporary downloaded file once the codes are safely stored elsewhere.
- Never rely on camera-roll screenshots, plaintext notes, or emailing codes to yourself.
- Generate a fresh set right away if the codes are ever used up or lost, rather than waiting.
None of this requires new software or a subscription. It is a habit applied at the moment 2FA gets turned on, using tools already in place: whatever password manager is already storing passwords, and a drawer or safe already used for other important paper.
This is a five-minute habit, not a special project, and it fits the same practical mindset covered in 5 Automation Myths That Keep Beginners From Starting. Saved backup codes handle the lockout side of personal-data upkeep; the other half is knowing when your information turns up somewhere it should not, which is exactly what How to Automate Alerts When Your Personal Data Shows Up in a New Breach walks through.