2FA backup codes: how to back up two-factor authentication so it never locks you (or your family) out

What are 2FA backup codes and why do they matter?

Passwords stopped being enough a long time ago. They leak in breaches, get reused across sites, and can be guessed, phished or bought. Two-factor authentication is the fix that actually works: even with your password in hand, an attacker still needs the six-digit code your phone regenerates every thirty seconds, or a physical key only you hold. If you care about an account, it should have that second lock.

But the second lock concentrates everything into one device. The secret keys behind those codes usually live only in the authenticator app on your phone. Lose the phone, break it, or die with it locked, and the codes are gone. Even someone holding all of your passwords can't get past it.

That is what backup codes are for. When you turn on two-factor authentication, most services hand you a set of single-use recovery codes. Google, for example, issues ten eight-digit codes; each works once, and generating a new set cancels the old one. Other services use a similar pattern under names like recovery codes, emergency codes or scratch codes. Whatever the name, they are the only way back in that does not depend on a device you might not have.

What are the three kinds of 2FA, and how is each one backed up?

Not all second factors fail the same way, so they are not all backed up the same way. It helps to know which kind each of your accounts uses.

• SMS and email codes

  The code arrives by text or email. There is nothing to back up as such, but there is plenty to lose: a phone number can be hijacked while you are alive, and after a death the contract is usually cancelled and the number eventually recycled. Treat SMS as the weakest option, keep the account's recovery codes anyway, and make sure whoever handles your affairs knows which number and email address the codes go to.

• Authenticator apps (TOTP)

  Apps like Google Authenticator, Authy, Microsoft Authenticator, 2FAS and Aegis store a secret for each account and turn it into a fresh code every thirty seconds. The secret is the thing to back up. Google Authenticator can sync codes to your Google Account and export them as QR images; Authy syncs encrypted backups protected by a backup password it cannot recover for you. Password managers such as 1Password and Bitwarden can hold the same secrets next to the password, so one encrypted vault carries both factors (on some plans this is a paid feature). Whichever app you use, the service's one-time recovery codes are still your fallback if the app and its sync both fail.

• Hardware security keys and passkeys

  A security key such as a YubiKey keeps its secret inside the hardware, which is the point: it can't be read out or copied. Yubico's own advice is to buy a spare and register it with every account at the same time as the primary, because an unregistered spare is useless later. Passkeys are similar in spirit but live in software; Apple's sync through iCloud Keychain, and the equivalents from Google and password managers, carry them between your own devices. Neither a key nor a passkey can be handed to a family member as a file, so for these accounts the recovery codes and a registered spare matter even more.

How do I back up my 2FA codes today?

Set aside an hour. The job is dull, but it only needs doing once properly and then a quick top-up whenever you add an account.

• List the accounts that have 2FA

  Open your authenticator app and write down every account in it, then add the ones that use SMS or a security key. Email, bank, phone carrier, password manager and cloud storage come first; they are the accounts other recoveries depend on.

• Download the recovery codes for each one

  In each account's security settings, find the backup or recovery codes and save the set. If you have ever used some of them, generate a fresh set so your copy is complete. Note the date beside each set.

• Export the authenticator secrets

  Most apps can export their accounts as one or more QR images, or sync to an account or vault. If your app offers export, take a screenshot of every QR image it shows, on that same phone. Together they are a complete, restorable copy of your second factor: installing any authenticator app and scanning them brings every code back. If your app offers no export (Authy, for instance), its own encrypted sync is the closest substitute, so record the backup password alongside your other recovery codes.

• Treat the copy like live keys

  Export only on hardware you control. Move the screenshots out of your camera roll immediately, delete them from Recently Deleted, and check that cloud photo sync hasn't already picked them up. Anyone holding those images can generate your codes.

Where should I store 2FA backup codes safely?

The usual places are the ones that fail. Screenshots in a downloads folder, codes emailed to yourself, a text file on the desktop: unencrypted, scattered, and impossible for anyone else to find years later. Backup codes should live in one place that is encrypted, that you will still have after losing a phone, and that someone you trust could reach one day.

• A password manager vault

  The most practical home for most people. Put each account's recovery codes in the notes of the matching login, and store the TOTP secret there too if your manager supports it. One vault, one master password, everything paired. The weak point is the vault's own recovery: 1Password's Emergency Kit PDF (with its Secret Key) and your manager's own 2FA codes need a home outside the vault.

• Paper in a safe place

  Printed codes in a sealed envelope, in a home safe or a safe-deposit box, survive every kind of device failure. The cost is that paper goes stale: every new account or regenerated set means reprinting.

• Not in the account it protects

  Recovery codes for your email should never sit only in that email. Codes for your password manager should never sit only in that vault. Each set has to be reachable without the thing it unlocks.

What happens to my 2FA when I die?

Nothing, and that is the problem. The authenticator app keeps generating codes on a phone nobody can unlock. The security key sits in a drawer, registered to accounts nobody can name. Text messages go to a number the carrier closes a few months later. Every account you protected carefully stays protected, now against the people you would have wanted inside.

A list of passwords alone does not solve this. Your partner can know the email password perfectly well and still be stopped at the second step; the same goes for the bank, the cloud photos and the domain renewal. Platform recovery processes exist for next of kin, but they are slow, vary by company and country, and usually give limited or no access. The practical route is the same one you would use yourself after a lost phone: recovery codes and exported secrets, held by someone who knows they exist. Our guide to passwords after death covers the password side of the same question.

How do I pass 2FA access to family?

Whatever method you choose, it has to meet three tests: the codes stay unreadable to everyone today, they reach the right person later, and that person knows how to use them. A sealed envelope passes the first and fails the third unless you add instructions. Whatever you choose, add one paragraph per account: what it is, which second factor it uses, where the codes are, and what to do first.

• Password manager emergency access

  Several managers let you name a trusted contact who can request access to your vault; Bitwarden's Emergency Access grants it after a wait time you set unless you decline, and is a feature of its paid plans. If your recovery codes and TOTP secrets live in the vault, this hands both factors over in one step. It depends on that person keeping their own account active and on the manager still existing, so pair it with a paper copy of the vault's own recovery details.

• A sealed note with a trusted person or solicitor

  Printed recovery codes, the authenticator export images and a short how-to, sealed and left with a lawyer or executor. Reliable and low-tech, but it goes stale fast, and you have to trust that the envelope is never opened early.

• A dead man's switch

  A service that holds your codes encrypted and releases them to chosen people only if you stop checking in. It adds the one thing a sealed envelope lacks: automatic delivery when you are no longer there to hand it over. See how a dead man's switch compares with a password manager for the trade-offs.

How does PostMortem handle 2FA backup codes?

PostMortem is a free iOS and Android app built as a dead man's switch. You create a message box, add the people who should receive it, and choose a check-in interval from hourly to twelve months. You check in with one tap in the app; reminders arrive by email and push as the interval runs down. If you stop checking in and the interval runs out, the box is released to your recipients.

For two-factor backups, a box can hold your login credentials with the recovery codes written alongside each password, a text message explaining which account uses which second factor, and up to five file attachments of 20 MB each, which is enough for the QR images exported from your authenticator app. Messages, passwords, file names and file contents are encrypted on your phone with AES-256 before upload and decrypted in the recipient's browser; PostMortem's servers never see the plaintext contents. The box name, recipient addresses and check-in schedule stay readable so reminders and delivery work.

Decryption needs an access key card, a QR-style image that you share with each recipient while you are alive. That card is what turns a released box into readable codes, so it should be stored with the same care as the codes themselves. Because the box is yours, the same copy is there for you the day you are setting up a replacement phone. More on the model is in how it works and the security page.

Frequently asked questions

• What is a 2FA backup code?

  A single-use code a service gives you when you turn on two-factor authentication. It replaces the usual code from your phone or key if that device is lost. Each one works once; most services let you generate a new set at any time, which cancels the old set.

• I lost my phone with my authenticator app. How do I get back in?

  Use the recovery codes you saved when you set up 2FA, or restore the app from its cloud sync or an export on a new phone. If you have none of those, each service has its own account recovery process, which can take days and may require proof of identity.

• What happens to 2FA when someone dies?

  The second factor keeps working against everyone, including family holding the passwords. Unless recovery codes or an authenticator export were saved and passed on, the only route is each platform's next-of-kin process, which varies by company and country and is often slow or limited. This is general information, not legal advice.

• Is it safe to store 2FA codes in a password manager?

  For most people, yes: an encrypted vault is safer than screenshots and keeps codes next to the passwords they pair with. The one rule is that the vault's own recovery details and its 2FA codes must live outside the vault.

• How do I give my family access to my 2FA without sharing it now?

  Use something that stays sealed until it is needed: a password manager's emergency access with a wait time, a sealed note with a solicitor, or a dead man's switch that releases encrypted codes only if you stop checking in. Add written instructions in every case.

• How often should I refresh my 2FA backups?

  Whenever you add an account to your authenticator, use a recovery code, or regenerate a set. A yearly check is a sensible minimum; the digital legacy checklist is a good time to do it.