Recovery codes to print or save after turning on two-factor authentication

Printing Recovery Codes for Safe Offline Storage

A set of recovery codes is usually provided by the service when two-factor authentication is enabled. These one-time use codes allow sign-in if your phone is lost or a verification code cannot be received. Printing those codes and keeping the paper copy in a secure place is the safest initial step. A printed page resists hacking, corruption, or accidental deletion, making it the most dependable backup method for regaining account access. The printer should be connected to a trusted device, and nobody else should be able to grab the printed page right away. Confirm that every code can be read clearly after printing and that the page includes the correct service name and date label.

Store the printed sheet in a locked drawer, a safe, or somewhere only you can access. The printed codes should never be kept inside a wallet, a laptop bag, or a desk drawer others can reach.

Saving Recovery Codes as an Encrypted Digital File

For those who prefer a digital copy, saving the recovery codes as a password-protected file is better than using a plain text note. Many services let you download the codes as a PDF or text file during the initial setup. Save that file to a folder that does not sync to cloud storage incorrectly, such as a local documents directory or an encrypted USB drive. This helps prevent the codes from being revealed if your cloud account gets compromised. A strong password that differs from your main account password should be used when saving the file. Obvious labels such as “recovery codes” or “2FA backup” should be avoided on the file name.

Something neutral like “setup notes 2025” makes it harder for someone who finds the file to understand its contents. Open the file once after saving to confirm the codes are still there and readable. Then place the USB drive or folder in a secure spot away from your primary device.

Checking Recovery Code Labels and Expiration Details

Every service may handle recovery codes somewhat differently. Some services put a number or status marker beside each code so you can keep track of which ones remain unused. Look for a “used” or “remaining” label before you need the codes in a real lockout scenario. Trying an already consumed code can cause a failed sign-in attempt, and a temporary lock may follow. Expiration on recovery codes is another detail worth verifying. After certain security setting changes or a set amount of time, some services generate fresh codes.

When expiration is a factor, produce a fresh set and update whichever printed or saved copy you keep. Check the security settings page to see whether creation date or expiration info is shown. No expiration displayed can be taken as valid approval until you regenerate the codes manually.

Testing One Recovery Code Before a Real Lockout

The real convenience of recovery codes can be confirmed by testing one while account access is still available. Sign out of one device, then attempt sign-in with a recovery code instead of the usual method. A working code demonstrates the rest are also valid properly and stored as needed. Troubleshoot while still able to sign in if the code does what it should not at first. Take only one single code from the collection when testing so the others remain for future emergencies. Mark that code as used on your printed or saved list after a successful test.

Do not test on a public or untrusted device, and do not share the code with anyone during the test. A failed test means checking whether you entered the code exactly as shown, including uppercase letters or dashes. When the format is correct and the code still does not work, generate a new set of recovery codes and repeat the storage steps.