Where to Store 2FA Backup Codes (and Where Not To)

Quick answer: Keep 2FA backup codes in your password manager or a locked notes app, plus one printed copy in a safe place. The codes that recover the password manager itself (and your main email) must live outside it, on paper or in a separate locked app. Never keep backup codes as screenshots, in email, in unlocked notes, or as plain files in iCloud Drive or Google Drive.

To build a printed recovery sheet, use the free 2FA backup codes checklist. It runs in your browser and nothing you list is sent or saved.

What are 2FA backup codes, and why does storage matter?

Backup codes (also called recovery codes) are one-time codes a service gives you when you turn on two-factor authentication. Each one bypasses your second factor once, so the set works like a spare key: stored badly, it weakens your strongest accounts; stored well, it saves you from a weeks-long account recovery.

They usually come as eight to ten short strings like 7c2k-9f4m, for the day your authenticator app, phone or security key is gone. An attacker who finds them only needs your password, and passwords leak all the time. Google, Apple and most exchanges can make you wait days to prove your identity if you lose both.

Should backup codes go in your password manager?

For most services, yes. A real password manager such as 1Password, Bitwarden or Proton Pass is end-to-end encrypted, syncs across devices and survives phone loss. The one exception is the password manager's own recovery codes, plus the email account that resets it: those must live outside the vault they unlock.

Paste each service's codes into the notes field of its login entry and you are done. For the two or three sets that recover the vault itself, use paper or a separate app, because when you need them, the door they open is the door they are behind.

Is it safe to store backup codes in a notes app?

It can be, if the app keeps them locked and does not leave a readable copy in the cloud. What matters: a passcode or biometric lock with short auto-lock, no email-based reset, and either no sync or end-to-end encrypted sync. A separate app also gives you separation: one compromised vault does not hand over the other.

How Secure Notes fits, plainly. On Android, the whole vault is encrypted by the app with AES-256 under a key derived from your PIN, never syncs, and blocks screenshots by default, which makes it a strong home for backup codes. On iPhone, Secure Notes does not encrypt notes itself; it relies on iOS Data Protection plus its own passcode and Face ID lock, with a per-note lock and an optional decoy PIN. That keeps codes away from someone holding your unlocked phone, but if you turn on iCloud sync, Apple holds the keys to synced notes. For the highest-stakes codes on iPhone, keep sync off and rely on paper as well. Full details are on our security page. Whatever app you use, keep one locked note per service and cross codes off as you use them.

What is the safest offline option?

Print the codes or copy them by hand, and keep the sheet somewhere fire-resistant and unobvious: a small home safe, a locked drawer, or a sealed envelope at a relative's house. Paper cannot be phished, synced or stolen by malware; its only enemies are fire, water and people inside your home.

Do not label the sheet “Google backup codes” in big letters; a header like “2FA, June 2026” is enough for you and useless to a burglar in a hurry. Reprint whenever you regenerate codes, and shred the old sheet.

Where should you never store backup codes?

Never in screenshots, email, unlocked notes, or plain files in a cloud drive. All four put the codes inside the same accounts and sync systems the codes are supposed to be independent of, so one stolen password exposes both factors.

Screenshots are the most common and the most dangerous: your camera roll syncs automatically, on-device text recognition makes “backup codes” searchable, and deleted images stay in Recently Deleted for about 30 days. Email is exactly the account an attacker phishes first, and 2FA exists to survive that. If you want a broader cleanup, run through the iPhone privacy checklist.

2FA backup code storage options compared

What is a simple setup that covers everything?

Everyday codes in your password manager, the codes that recover the password manager and your main email in a separate locked place, one printed sheet of the most important codes, and a cleanup of old screenshots. Four steps, about twenty minutes.

1. Everyday services (banks, social, work): paste backup codes into the matching entry in your password manager.
2. The password manager itself and your main email: keep those codes on paper and, if you want a digital copy, in a separate locked app such as Secure Notes, so a vault lockout cannot strand you.
3. One printed sheet of the highest-stakes codes (email, password manager, Apple Account) in a fireproof safe or with family.
4. Cleanup: delete old screenshots (including Recently Deleted), regenerate code sets after using a few, and update the printout when you do.

The same logic scales up to bigger secrets; see how to store a crypto recovery phrase and whether passwords belong in a notes app. If your codes already live in a password manager, read 1Password secure notes vs a locked notes app.

Frequently asked: storing 2FA backup codes