How to Secure Your Two-Factor Authentication Backup Codes

Step by step

1. 1 min

   Generate and display your codes

   Log in to your account provider's security settings page. Navigate to the Two-Step Verification or Multi-Factor Authentication section and select the option to Generate Backup Codes or Recovery Codes. Once displayed, keep this window open; do not navigate away until you have verified your storage method.

   Note: Never generate new codes unless you are ready to discard the old ones, as this often invalidates previous sets.
2. 2 min

   Store codes in an encrypted vault

   Open your designated password manager. Create a new secure note or a dedicated login entry for the service, inputting the backup codes exactly as provided. Ensure the entry is protected by your master password and that the vault utilizes end-to-end encryption.

   Note: Avoid storing these codes in plaintext files, screenshots, or unencrypted cloud notes.
3. 1 min

   Create a physical backup

   Print the codes using a local, non-networked printer if possible. If you must use a network printer, ensure the print queue is cleared immediately after the job completes. Write the name of the service clearly at the top of the page before storing the document.

   Note: Do not leave these papers in plain sight on a desk.
4. 30 sec

   Secure the physical media

   Place the printed codes inside a fireproof safe or a secured, locked filing cabinet. Treat this physical paper with the same level of security as a passport or birth certificate. If you do not have a safe, use a tamper-evident envelope tucked away in a low-traffic location.

5. 30 sec

   Test one code

   Many services allow you to verify a single code to ensure it was transcribed correctly. If the provider supports this, enter one of the codes into their verification tool to confirm functionality. Once confirmed, finalize the setup process in your account settings.

   Note: Only use one code for testing; keep the remainder unused for emergency access.