Your Backup Codes Should Not Live on Your Phone
Matthew Leo · Published August 31, 2026 · Guides
Backup codes are supposed to rescue you when your normal sign-in method disappears. Saving the only copy on the same phone that receives your authentication prompts defeats much of the point.
Google and Microsoft both explicitly recommend keeping recovery material somewhere separate from the device used to sign in. That sounds obvious until you look at how people actually store it: screenshots, a note app, a download folder or a photo buried in the same handset they are trying to protect.
What a backup code actually does
A backup code is an alternate proof that you are authorized to enter an account. Google issues ten one-time codes when 2-Step Verification is enabled. Once a code is used it stops working, and creating a new set invalidates the old set.
Microsoft’s account recovery code works differently. It is a 25-digit recovery credential, and generating a replacement invalidates the previous one.
These are powerful credentials. Treat them more like spare keys than ordinary notes.
The simple storage rule
Keep at least one recovery method outside the failure domain of your everyday devices.
For many people, the easiest option is a printed copy stored with important documents. Google specifically suggests storing printed backup codes somewhere safe, such as where you keep your passport. Microsoft also recommends printing its recovery code and says not to store it on a device used to sign in to the account.
A secure physical copy has an underrated advantage: a stolen password, cloud-account compromise or ransomware infection cannot remotely read a piece of paper in a locked drawer.
Digital copies can work, but avoid circular recovery
An encrypted password manager is a reasonable place for recovery information if you also have a way to regain access to that password manager without the missing device.
Ask yourself a slightly annoying question: “If my phone and laptop vanished together, how would I open this?” If the answer requires a prompt on the vanished phone, your digital backup is not independent.
The same problem applies to emailing recovery codes to yourself. If the code is meant to recover that email account, storing it only inside the account creates a loop.
Do not photograph every recovery secret
Photo libraries are designed to synchronize. That is convenient for holiday pictures and less attractive for credentials. A screenshot may end up copied to multiple devices, cloud backups and shared libraries without you thinking about it.
If you temporarily photograph a code while setting things up, move it to the intended secure location and delete the image, including from recently deleted items.
Refresh the kit when something changes
Generate new backup codes if you think an old copy was exposed. Google says a newly generated set automatically invalidates the old one. Microsoft does the same when a new recovery code is created.
Also review recovery information when you replace a phone, change a number, move to a new password manager or lose a hardware security key.
The mental model is simple: your recovery method should survive the event it is designed to recover from. If losing your phone also loses your backup codes, the backup was never really a backup.
Sources: Google Account Help: Sign in with backup codes; Microsoft Support: account recovery codes.
Tags: security, 2FA, account recovery