🔐 2FA Backup Codes: What They Are and How to Store Them Safely (2026)
On this page
Around 10% of people who lose their phones also permanently lose access to accounts they could never get back — not because they forgot their password, but because they had enabled two-factor authentication without ever saving their backup codes. It is the most avoidable account lockout in security, and it happens every day.
What Are 2FA Backup Codes?
A 2FA backup code (also called a recovery code or emergency code) is a one-time-use alphanumeric passcode, typically 8–10 characters, that a service generates for you when you first enable two-factor authentication. Unlike your TOTP authenticator codes that rotate every 30 seconds, backup codes are static — they do not expire on a schedule. Instead, each code is invalidated the moment you use it to log in.
Most platforms (Google, GitHub, Dropbox, Stripe, and virtually every service that supports 2FA) provide between 8 and 10 backup codes at setup time. You are expected to copy or print them immediately and store them somewhere safe, separate from your phone.
Their sole purpose is emergency access: if you lose your phone, replace your device, accidentally delete your authenticator app, or your hardware security key is stolen, backup codes are the only way to get back in without going through a lengthy, uncertain account recovery process.
Why Most People Lose Their Backup Codes
The problem is not that people do not intend to save their backup codes — it is that the moment of setup is the least convenient moment to think about disaster recovery. You enable 2FA, a screen shows ten random strings, you click "done" without copying them, and they are gone until you need them. By then, it is too late.
A 2024 account recovery analysis by identity provider Auth0 found that approximately 37% of account recovery requests from users with MFA enabled cited "lost authenticator device with no backup codes stored" as the cause. A significant fraction of those users never regained access to affected accounts — particularly on platforms with limited support capacity or where the account email was itself locked.
The three most common failure patterns:
- Screenshot stored in the phone's camera roll — the same phone that broke or was stolen.
- Plain text file saved on the desktop — readable by any malware or anyone with access to the machine.
- Copied to the notes app — backed up to an iCloud or Google account that the user could not access without the very authenticator they lost.
All three methods share a critical flaw: they collapse your backup codes and your second factor into the same failure domain. Lose one, lose both.
Storage Methods Compared
| Storage Method | Security Level | Survives Device Loss? | Recommended? |
|---|---|---|---|
| Password manager secure note (AES-256) | High | Yes | Yes — best option |
| Printed paper in locked storage | High (offline) | Yes | Yes — good secondary backup |
| Encrypted USB drive | High | Yes (if separate from device) | Acceptable |
| Cloud notes app (Notes, Keep) | Medium | Depends on cloud access | No — circular dependency risk |
| Email inbox | Low | Only if email is accessible | No — easily compromised |
| Screenshot in camera roll | Low | No (lost with device) | No |
| Plain text file on desktop | Very low | No | Never |
What NIST and NCSC Say About Recovery
NIST SP 800-63B (Digital Identity Guidelines) is explicit about the need for authenticator recovery mechanisms. It states that organizations "shall provide a mechanism for users to recover from loss of an authenticator" and that this mechanism "shall be treated with the same level of security as the primary authenticator itself." In practical terms: backup codes must be protected just as strongly as your main second factor.
"Verifiers shall provide a mechanism for users to recover from the loss of an authenticator in a manner that maintains the security of the authentication process." — NIST SP 800-63B, Section 6.1.2: Authenticator Recovery
The UK National Cyber Security Centre (NCSC) echoes this in its MFA guidance, noting that backup methods should be stored "in a different location to your primary authenticator to ensure you can still access your accounts if your primary method is unavailable." Their guidance specifically warns against storing backup codes on the same device as your authenticator app.
"Back up your recovery codes somewhere safe — separate from the device you use for two-factor authentication." — NCSC, Multi-Factor Authentication for Online Services (2024 edition)
OWASP's Authentication Cheat Sheet adds a technical note: backup codes should be treated as authenticator secrets and stored hashed server-side, and clients should be warned that each code is single-use. From a user perspective, this means you should assume any code you enter is gone immediately.
Step-by-Step Secure Storage Guide
Here is a concrete process to follow every time you enable 2FA on a new account:
- Enable 2FA on the service and complete the setup flow until the backup codes screen appears. Do not click "done" yet.
- Open your password manager in a separate browser tab or window. Navigate to the secure notes section.
- Create a new secure note titled clearly (e.g., "GitHub — 2FA backup codes, generated 23 Sep 2026"). Paste all backup codes directly into the note body. Include the date so you know how old the codes are.
- Save the note and confirm it appears in your vault before closing the backup code screen.
- Optionally, print the codes and store them in a locked drawer, filing cabinet, or safe. Paper is immune to cyberattacks. Keep it physically separate from your devices.
- On the service's 2FA screen, confirm you have saved the codes and click done.
- Test immediately: log out of the account, log back in, and when the 2FA prompt appears, enter one of your backup codes instead of your authenticator code. Confirm it works. Then regenerate a new set if the service consumed that code (some do; some provide a way to test without consuming).
This process adds about 90 seconds per account setup. The account lockout it prevents can take days — or be permanent.
Locked Out With No Backup Codes?
If you are currently locked out of an account with no valid backup codes, here are your options in order of likelihood of success:
- Check if a trusted device is still logged in — many services allow session-based bypass if you have an active session on a browser that was previously authenticated. Disable cookies clearing or session wipe tools first.
- Use SMS fallback if available — some services let you receive an SMS code instead of using your authenticator, if you registered a phone number at setup. Try the "use another method" option at the login prompt.
- Contact account support with identity verification — Google, Microsoft, GitHub, and most major services offer account recovery via identity verification. This typically requires access to your registration email, original phone number, a trusted device fingerprint, or in extreme cases a government-issued ID. Expect a process that takes one to five business days.
- Accept the loss — some services (particularly high-security financial or cryptocurrency platforms) cannot restore access under any circumstances if all second factors and backup codes are lost. This is by design, not a policy failure.
Once you regain access, the first thing to do is regenerate new backup codes and store them correctly using the method above.
Using a Password Manager to Store Backup Codes
A password manager with secure notes is the recommended solution because it solves the core problem: backup codes need to be encrypted, accessible from multiple devices, and separate from your authenticator. All three conditions are met by a properly configured password manager.
The important operational rule is to keep your password manager on a different device than your primary authenticator app, or at minimum ensure your password manager is accessible via a second device (a tablet, a work laptop) in an emergency. If your phone is your only device and it contains both your authenticator and your password manager, losing the phone eliminates both.
For users who want a dedicated solution, NordPass supports encrypted secure notes alongside password storage, uses XChaCha20 encryption at rest, and has zero-knowledge architecture — meaning even NordPass employees cannot read your stored backup codes. This makes it a suitable vault for credentials you never want exposed.
Bitwarden, 1Password, and Dashlane all offer equivalent secure notes functionality. The specific manager matters less than the practice of using one consistently.
One final note: regenerate your backup codes periodically — any time you suspect a breach, after using any of them, or at minimum once a year. Old, partly consumed sets are a security liability: you may not know how many valid codes remain, and an attacker who obtained your codes years ago may still hold valid ones.
Frequently Asked Questions
What are 2FA backup codes?
2FA backup codes (also called recovery codes) are one-time-use alphanumeric passcodes generated when you first enable two-factor authentication on an account. They let you bypass your authenticator app and regain account access if your second factor — a phone, hardware key, or authenticator app — is unavailable. Each code can only be used once and a new set should be generated after any code is consumed.
Where should I store 2FA backup codes?
The safest approach is a password manager's encrypted secure notes (NordPass, Bitwarden, 1Password) and optionally a printed copy in a locked location. Never store them in your email inbox, plain text files, or in the same app as your authenticator. The key principle: your backup codes must be stored separately from the second factor they replace.
Can backup codes be used more than once?
No. Most 2FA backup codes are one-time-use only — once you enter a code to log in, the service immediately marks it as consumed. You typically receive 8 to 10 codes per set. Once all codes are used, you must generate a new batch in your account security settings.
What should I do if I lose my 2FA backup codes?
If you still have access to your account, regenerate a new set immediately in your security settings. If you are locked out, use a still-active session, SMS fallback, or go through the platform's account recovery process (which requires identity verification and may take days). Some platforms cannot recover access if all second factors and backup codes are lost.
Are 2FA backup codes safe to store in a password manager?
Yes — storing backup codes in a password manager's secure notes is one of the safest options available. Password managers encrypt notes at rest using AES-256 or equivalent and use zero-knowledge architecture, meaning the provider cannot read your stored data. The key caveat: keep your authenticator app and your password manager accessible from separate devices where possible, so losing one device does not eliminate both your second factor and your backup codes.