Backup codes and account recovery: set them up before you need them
2 min read · Updated October 15, 2026
Download or print your backup codes and store them offline, make sure your recovery email and phone number are current and consider a second authentication method. Recovery details protect you from lockouts, but outdated ones are a common route for attackers.
What backup codes are
Backup codes are one-time codes you can use if your normal second factor is unavailable. Each code works once. Services usually generate them when you enable two-factor authentication.
Store them safely
- ✓Print them and keep them somewhere secure, such as a locked drawer.
- ✓Or store them in your password manager’s secure notes.
- ✓Do not keep them in the same email account they protect.
- ✓Regenerate them if you think they were exposed.
Is your login already in a leak?
Strong habits help most when you know which accounts are already exposed. Check your email address for free.
Keep recovery details current
Recovery email addresses and phone numbers let you reset access. If they point to an old, abandoned or compromised account, an attacker may use them to take over yours. Review them whenever you change number or email.
Prepare for losing your phone
Add a second authenticator or security key, make sure your authenticator app can be backed up, and know how to recover your password manager. A short written recovery plan saves a lot of stress.
Frequently asked questions
How many backup codes do I get?+
It varies by service. Each works only once.
Are backup codes safe to store in a photo?+
Avoid photos that sync to cloud galleries. Use a password manager or a printed copy.
What if I lose my backup codes?+
Generate new ones as soon as you can, which usually invalidates the old set.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.