Accounts & trust

Recovery codes are useful only if you can reach them

Where to keep account recovery codes, how they differ from passwords and what to check before losing access to your phone.

A recovery code stored only on the phone you have just lost creates an awkward circle. The same is true of a code kept in an account that requires that phone to open it.

Understand what the code replaces

Some services provide backup codes for situations where the usual second sign-in step is unavailable. Google, for example, offers single-use backup codes. Other services have different recovery rules, so read the instructions attached to your own codes.

Do not assume a recovery code replaces your password or proves ownership in every situation. Nor should it be shared with someone who offers to “check” your account.

Separate the points of failure

Choose storage you could reach if your everyday phone stopped working. Depending on your circumstances, that might be an encrypted store accessible from another device or a paper copy in a secure place. Think about who else could access it, and whether you can read it when you need it.

Avoid leaving a screenshot in a shared photo library or sending the codes through an ordinary message just for convenience.

Check without locking yourself out

While still signed in, confirm that the codes belong to the correct account and that you know the recovery procedure. If you deliberately test a code, mark it used and follow the service’s rules for replacements. When generating a new set, replace the old stored set so that an emergency does not begin with an obsolete printout.

Sources & further reading

  1. Google — Sign in with backup codes

Sources support the technical explanations. Examples and suggested checks are editorial guidance.