Two-factor recovery codes: where people actually lose them

What a recovery code actually is

When you turn on two-factor authentication using an app like Google Authenticator or Authy, the service usually hands you a batch of 8 to 10 recovery codes at the same time. These are separate from the six-digit codes your authenticator app generates every 30 seconds. They’re single-use. They exist to get you back into your account if the thing generating your regular codes disappears: your phone gets wiped, stolen, replaced, or the app gets uninstalled without you transferring the underlying seed first.

The two-factor code and the recovery code solve different problems. The rotating code proves you still have the device that was paired at setup. The recovery code proves you’re the account owner even when that device is gone. Lose the device and still have the recovery codes. You’re back in within a minute. Lose both, and you’re stuck doing an identity-verification process with the service’s support team. That can take anywhere from a few hours to over a week, depending on the company and how well you can prove who you are.

Why the loss happens later, not at setup time

Nobody loses their recovery codes on the day they generate them. The codes get created, saved somewhere that feels reasonable at the time, and then sit untouched for months or years. The failure shows up later. That’s when the original context that made the storage choice sensible has quietly changed: the phone got replaced, the laptop got wiped for resale, the move happened and a box never got unpacked. Recovery codes are a bet on your own memory and your own future setup remaining stable. That bet is exactly the one that tends to lose.

Where people actually lose them

A few patterns show up over and over.

Screenshot on the phone that generates the codes. This is the most common one. It’s also the most fragile, because the storage location and the thing you’re protecting against (losing that phone) are the same device. If the phone is lost, stolen, or factory reset, the screenshot goes with it.

Saved into the same account’s cloud photo library. Someone screenshots their Google account recovery codes. It auto-backs up to Google Photos. If the reason you need the recovery codes is that you’re locked out of your Google account, the codes are now sitting inside the account you can’t get into. This is a circular dependency. The backup and the thing it’s backing up are the same lock.

Printed and put in a drawer, then the drawer moves. Paper survives phone resets and app deletions. That makes it genuinely more durable than most digital storage. But paper also gets thrown out during a move, damaged in a spill, or forgotten in a filing cabinet nobody opens for three years. Durable doesn’t mean findable.

Saved as a note on a device that later gets wiped for resale or handed down. People are usually careful about wiping a phone or laptop before selling it. They’re less careful about checking what’s inside the notes app first. The recovery codes get deleted along with everything else. Nobody notices until the next login problem.

Stored in a password manager entry for a different account, or under a vague label. A lot of password managers support attaching custom notes or files to an entry. That works well if the codes are saved as their own labeled entry. It works badly if they get tucked as a note under the wrong service, or under a nickname that made sense for a week and means nothing six months later.

Given to the wrong version of the account. People sometimes regenerate recovery codes when re-enabling 2FA after a phone change. The old code screenshot never gets replaced. Regenerating a new batch invalidates the old one silently. The old codes still look intact in whatever notes app they were saved to. They no longer work.

Why “just write it down” isn’t a complete answer

Writing codes on paper is a reasonable piece of a plan. But treating it as the whole plan misses how paper actually fails. A single printed sheet is one flood, one move, or one decluttering pass away from gone. It also assumes you’ll remember where you put it a year later, across dozens of other accounts that each generated their own sheet. The realistic failure is you, eighteen months from now, needing them at 11pm with no memory of which drawer, which notes app, or which old phone they’re on. A burglar taking your recovery codes is nowhere near the top of the list.

The fix is making sure the storage doesn’t share a single point of failure with the thing you’re protecting. It also needs to be labeled well enough for future-you to find. No single storage method is perfect on its own.

A storage approach that actually survives normal life

A few practical habits cover most of the failure modes above without requiring a dedicated system.

Store recovery codes somewhere that doesn’t depend on the same device or account you’d need them to recover. If the codes are for your Google account, don’t store them exclusively in Google Photos, Google Drive, or a Google Doc.

If you use a password manager, save the codes as a note attached to the correct entry, with a clear label like “recovery codes, generated [date].” Most password managers sync across devices independently of the accounts they’re storing credentials for. That breaks the circular-dependency problem, as long as you’re not locked out of the password manager itself for the same reason (lost phone, no backup access).

If you keep a printed copy, treat it the way you’d treat a spare house key. One location you’d actually remember under pressure, not a drawer that also holds old receipts. A second copy in a different physical location covers the flood-or-move scenario without much extra effort.

When you regenerate recovery codes after a phone change or a re-enrollment, delete the old copy in the same sitting you save the new one. The old codes look identical to the new ones. There’s no visual cue that they’ve expired.

What to actually check before you need this

The useful moment to think about recovery codes is a five-minute check right after you enable 2FA on an important account, well before you’re ever locked out. Open wherever you saved the codes, confirm you can actually find them without guessing, and confirm the storage location isn’t gated behind the same account. Do that once per important account (email, primary cloud storage, anything tied to password reset flows for other services). The odds of a bad night drop substantially.

None of this makes an account unbreakable. No single storage habit here is a complete fix on its own. It just means that when a phone breaks or a laptop gets wiped, the fix is a five-minute lookup instead of a support ticket and a wait.

If you want more of this kind of practical, no-nonsense breakdown of how privacy and security tools actually work, come find us at The Privacy Wire.