Security basics
What are recovery codes, and where should you keep them?
These backup codes can help when your phone is unavailable. Store them separately from everyday codes so you can find them when needed.
Recovery codes are backup credentials issued by a website, not the changing numbers in an authenticator. Keep them somewhere secure that you can still reach after losing your phone, and update your saved copy when codes are used or replaced.
In this article
Recovery codes, setup keys, and backups: what is the difference?
A service recovery code provides fallback verification for that service. A setup secret generates future rotating codes. An authenticator backup restores one or more entries. Similar names do not make these formats interchangeable.
Label stored material with the service, an account alias and its generation batch. Do not put a password or complete secret in the filename, where a file listing could expose it.
Keep recovery codes reachable without your phone
A photo library reachable only from your phone is a poor sole fallback for losing that phone. A file behind the very account requiring the missing code can create another recovery loop.
Consider a protected offline copy or an encrypted vault with an independent recovery route. A paper copy also needs protection from visitors, loss and physical damage, not just online attackers.
Update your saved copy after using or regenerating codes
Replacement rules vary. Google, for example, invalidates a used backup code and invalidates an old set when a new set is generated. Do not assume every service follows identical rules.
Keep a simple record of the batch, storage locations and use. After replacement, update the copies you actually rely on so an emergency does not send you searching through obsolete batches.
Find the file before you need it
Try locating your recovery material from another trusted device and check how to open it. For a full rehearsal, use a dedicated test account and keep other signed-in devices available.
Use Authenticator Cloud in the app or extension for everyday codes, and organize recovery codes separately. A clear storage location saves searching through photos and downloads later.
References
See the official guides above for detailed setup instructions.
Use Authenticator Cloud to organize the accounts you sign into regularly.
