Blog

The eight backup codes nobody writes down

2026-09-25

This post contains affiliate links. As an Amazon Associate, ZAGO.TO earns from qualifying purchases.

You switched on two-step sign-in. Good. Somewhere in that setup a page showed you eight or ten short codes, told you to keep them safe, and offered a Download button. You probably pressed Continue.

Those codes are the only thing standing between you and a support queue on the day your phone goes into a lake. Here is what they are, where they should live, and the small habits that make them work when you finally need one.

What the codes actually do

Each code is a one-time key. It stands in for your authenticator app or your text message exactly once, then it is dead. Eight codes means eight emergencies, not eight people who can share them.

That has two consequences people tend to miss.

First, they only matter when your phone is gone. Lost, stolen, broken, wiped, or replaced without moving the authenticator app across. So wherever you keep them, it cannot depend on that phone.

Second, making a new set cancels the old one. Most services will let you generate fresh codes whenever you like, and the moment you do, every code on your old sheet stops working. Plenty of people discover this at the worst possible time, holding a sheet from three years ago.

Why the phone is the wrong home

The usual move is a screenshot, and we went through why that goes badly in a separate piece: it ends up in a synced, searchable photo library forever.

There is a simpler objection too. The screenshot is on the phone. The codes exist for the day the phone is not available. Keeping your recovery keys on the device they are meant to replace is like keeping the spare house key inside the house.

The same is true of a note in the phone's notes app, or a message to yourself in a chat that you only sign into from that phone.

Where they should live

There is no single right answer, but there is a right shape: at least one copy that survives losing every device you own.

On paper. This is the answer security people give most often, and for once the old-fashioned option is the strong one. Print the page or copy the codes by hand. Paper cannot be searched remotely and does not sync anywhere. Put it with your passport or birth certificate, somewhere you would look in an emergency and a burglar would not bother with.

In a password manager. Bitwarden, 1Password, Apple Passwords and the like all have a place for secure notes. This is a good second copy. Check one thing first: if unlocking that manager on a new device itself needs your phone, it cannot be your only copy.

With someone you trust. For an account that really matters, a sealed envelope with a family member is reasonable. Label it plainly so they know what it is and who to hand it to.

Two copies in two different kinds of place is the goal. Paper plus a password manager covers nearly everyone.

Getting them off the phone

If you set this up on your phone, the codes are on the phone screen, and the printer is on the laptop. That gap is the whole reason people take the screenshot.

Options, in rough order:

• Open the account's security settings on the laptop instead and view the codes there. Most services let you. Then print from there, and nothing needs to cross devices.
• Copy them by hand onto paper straight from the phone screen. Eight short codes takes two minutes.
• If you must move them as text, use something that does not keep a copy. A short-lived hand-off such as ZAGO.TO, which we make, holds text for about a minute and then removes it. Be aware that our server can read that text while it is there, so for codes this important, the laptop route above is better.

Three habits that make them useful

Write the date and the account on the sheet. "Google, main account, created 25 Sep 2026." Without that, you will not know in three years whether the sheet still works or which account it opens.

Cross off each code when you use one. Every code works once. A sheet with two crossed out tells you that you have six left. A sheet with none crossed out after you have used three will send you in circles.

Make a new set when you get low, and throw the old sheet away. When you are down to two or three, generate fresh ones, print them, and shred the old page. Remember that the new set cancels the old, so do not leave the old sheet in the drawer to confuse you later.

The ten-minute version

Open your main email account on a computer. Find the backup codes in the security settings. Print them, write the date on top, and put the page with your important documents. Delete any screenshot of them from your phone, and then from the recently deleted album too.

That is the whole job. It takes about ten minutes, and it is the ten minutes you will be most grateful for.