Save your backup and recovery codes properly

Backup codes are the spare key for when your phone is lost, dead, or stolen. Saved well they are a lifesaver; saved badly they are a liability.

1. When a service offers backup or recovery codes during 2FA setup, do not skip that step — generate them.
2. Treat them like cash: each code logs in once, then is spent.
3. Store them offline — printed and locked away, or in your password manager’s secure notes, not in a plain email to yourself.
4. Avoid storing them only on the same phone that runs your authenticator, or losing the phone loses both.
5. Keep a copy somewhere a trusted person could reach in a genuine emergency.
6. Regenerate a fresh set if you ever suspect the old codes were seen, which invalidates the old ones.