Backup or recovery codes are emergency credentials, not ordinary notes. Store them so they remain available when a phone is lost, damaged, replaced, offline, or locked, while keeping them away from people who should not control the account. The safest plan avoids making the same phone both the everyday authenticator and the only place that holds recovery material.
Inventory account recovery paths
For each important account, record whether it offers one-time backup codes, a single recovery code, security keys, trusted devices, recovery email, or another supported method. Record the generation date and storage location without copying the code into the inventory. Do not assume every provider uses the same lifecycle.
Google says its backup codes can be used when the normal second step is unavailable. Its backup-code guidance states that a used code becomes inactive, a new set invalidates the previous set, and a printed copy can be kept with other important documents. Google also says not to share the codes.
Microsoft uses a different model for personal accounts. Its recovery-code guidance describes a 25-digit recovery code, says generating a new one invalidates the prior code, and recommends keeping it somewhere safe rather than on a device used to sign in. Follow the provider's current instructions rather than treating Google's and Microsoft's codes as interchangeable.
Choose storage with separate failure modes
Use at least one location that does not depend on the phone being recovered. Options include a printed copy in a physically secured location, an encrypted credential vault available from another trusted device, or an organizational break-glass process with access logging. Avoid screenshots in the phone's photo library, unencrypted cloud notes, chat messages, email drafts, or labels that publicly identify the account and purpose. Anyone who can read recovery material may be able to use a provider's emergency sign-in path.
Test without creating a lockout
- Confirm the account has another working sign-in method before testing.
- Generate or refresh codes from the official account-security page.
- Save the new material in the approved location before discarding the old copy.
- Test one code only when the provider supports safe one-time use and another method remains available.
- Mark a tested one-time code as spent; never assume it can be reused.
- Confirm a trusted person or administrator can locate sealed recovery instructions if the plan depends on them, without exposing the code during routine review.
Rotate after exposure or use
Generate new recovery material after a code is lost, viewed by an unauthorized person, stored in an insecure location, or consumed during recovery. Replace every stored copy and destroy obsolete paper or files appropriately. Review the plan after a phone change, authenticator change, account administrator change, or provider security update.
A good checklist proves both availability and separation: recovery material exists, is current, and can be reached without the unavailable phone, but it is not casually copied across the same devices and accounts it is meant to recover. Keep the provider's official recovery page in the inventory so future reviews can confirm whether the lifecycle or storage instructions changed.
Sources
- Sign In with Backup Codes — Google Account Help
- How to Get a Microsoft Account Recovery Code — Microsoft Support