Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The safest approach is layered storage: generate a fresh recovery-code set, place one copy in an encrypted password-manager note, and keep a second copy printed or handwritten in a locked, fire-resistant document safe. Treat every code like a password, never share or email it, and replace the entire set after a code is used, the set is exhausted, or you suspect exposure. Before changing phones, confirm that you can access your stored codes and at least one other recovery method.
Backup codes are emergency credentials. They are designed for the moment your phone, authenticator app, or security key is unavailable, so your storage plan must protect both confidentiality and availability.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat are two-factor authentication backup codes?
Backup codes are one-time credentials issued by an online service after you enable two-factor authentication (2FA). Each code can substitute for your normal second factor when you cannot receive a text, open an authenticator app, or use a security key. They are not a replacement for your password or your everyday second factor; they are an emergency access path.
Because anyone who obtains an unused code may be able to bypass your second-factor prompt, protect the codes with the same care as your password. GitHub explicitly tells users not to share or distribute recovery codes and recommends storing them in a secure password manager. Login.gov describes backup codes as its least-secure 2FA option because possession of the printed codes is enough to use them.
#1 Best Overall
- FIRE AND FLOOD PROTECTION FOR ESSENTIAL PAPERS: UL Classified to withstand high temperatures for up to thirty minutes and ETL Verified to protect contents during water exposure, helping safeguard critical paperwork during common home emergencies
- DESIGNED FOR IMPORTANT DOCUMENT STORAGE: Spacious interior fits hanging file folders and is ideal for organizing passports, birth certificates, insurance records, and legal paperwork
- KEY LOCK SECURITY YOU CONTROL: Durable key lock helps prevent unauthorized access and keeps the lid securely closed during fire events. Two keys are included for backup access
- HOME FRIENDLY SIZE WITH PORTABLE DESIGN: Compact footprint fits easily in closets, offices, or under desks while remaining portable enough to relocate when needed
- BUILT FOR EVERYDAY PEACE OF MIND: Black exterior offers a clean, neutral look that blends into home or office spaces while providing dependable document protection year round
Code counts and formats differ by service. Login.gov currently creates ten codes and permits each code once. GitHub documents sets of 16 recovery codes, and generating a replacement set invalidates every code from the earlier set. These are provider-specific examples, not universal limits.
Where should I keep my 2FA backup codes?
Keep two controlled copies in different places: a protected digital copy in an encrypted password-manager vault and an offline paper copy in a locked, fire-resistant document safe. Separating the copies means a lost phone, a dead battery, an internet outage, or a single damaged location does not remove every recovery path.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use an encrypted password-manager note as the primary digital copy
Create a protected note in a password manager that uses strong encryption and whose recovery process you understand. NIST describes password managers as encrypted storage that can improve both security and convenience. Give the note a neutral but recognizable title, record the account name and date of generation, and mark codes as spent as you use them. Do not put the codes in a general notes area that is not protected by the vault.
The password manager itself becomes part of your recovery plan. Make sure you know how to unlock it on a replacement device, whether it supports an offline copy of your vault, and how account recovery works if you lose the manager’s main password. A vault that cannot be opened during an emergency is not a useful backup.
Keep a physical copy away from your phone
Print the codes or write them legibly on paper, then place the sheet in a locked, fire-resistant document safe or another controlled offline location. NIST says saved recovery codes are intended to be maintained offline, such as printed or written down, and stored securely. A U.S. House cybersecurity handbook also identifies a password manager or physical safe as suitable storage.
Control physical access. Login.gov warns that printed or written codes are vulnerable to theft and phishing. Do not leave the sheet in an unlocked desk, wallet, car, or shared office. Check the paper periodically for water, heat, fading, or evidence that someone has handled it, and replace it if it is damaged or its location is no longer private.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is the safest way to store recovery codes?
Use a workflow that creates, stores, separates, verifies, and rotates the codes. Complete it immediately after enabling 2FA, while you still have access to the account.
- Open the account’s security settings. Sign in, go to the security or 2FA section, and choose the option to generate, display, or download recovery codes. Generate a fresh set rather than copying an old screenshot or document.
- Save the digital copy. Enter the complete set into a protected note in your encrypted password-manager vault. Confirm that the note is synchronized only through the manager’s secure service and that you can find it without relying on the phone that supplies your normal 2FA prompt.
- Create the offline copy. Print or handwrite the same set. Include the service name and the date, but do not add your password or authenticator secret to the page. Put the sheet in a locked, fire-resistant safe.
- Separate the dependencies. Keep the paper away from the phone, authenticator seed, primary password, and recovery email device. Storing every credential together defeats the purpose of having a backup.
- Remove exposed copies. Delete screenshots from the camera roll, downloads folder, recycle bin, cloud photo library, email, chat history, and shared drives. Do not paste codes into an ordinary notes app or an unencrypted cloud document.
- Verify access without consuming a code. Open the password manager on a second trusted device or in its offline mode, locate the note, and confirm that you can reach the safe. Check that an alternate factor is enrolled. Do not test by submitting a code unless the service clearly tells you that it will remain available afterward.
- Record the maintenance rule. Note where the physical copy is held and when you last checked it. If another trusted person must help during an emergency, give them access to the safe through your established estate or household process, never by sending a code in a message.
Use each code once and treat it as spent immediately. When the service offers regeneration, create a new set after any use, after the list is exhausted, or whenever you think a code may have been seen. GitHub states that generating a new set invalidates all previous recovery codes, so update both your password-manager note and your paper copy at the same time.
Rank #2
![[𝟑𝟓𝐌𝐢𝐧 𝟏𝟕𝟎𝟎°𝐅] Fire Proof Safe for Home Documents 4.5 Cuft | Fireproof Safe for Home , Home Safes With Removable Shelf, 𝟒𝟒𝐋𝐛𝐬 Heavy Duty Safes with Anti-theft for Home, Office](https://m.media-amazon.com/images/I/41uyuoittuL._SL160_.jpg)
- 🔥[𝟑𝟓 𝐌𝐢𝐧𝐮𝐭𝐞𝐬 𝐨𝐟 𝐓𝐫𝐮𝐬𝐭𝐞𝐝 𝐅𝐢𝐫𝐞 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧] Designed to protect what matters most. This fireproof safe for home can withstand high temperatures for up to 35 minutes, helping safeguard important documents, passports, cash, and valuables during unexpected house fires. 𝐈𝐧𝐭𝐞𝐫𝐧𝐚𝐥 𝐝𝐢𝐦𝐞𝐧𝐬𝐢𝐨𝐧𝐬: 14.17'' L*11.61''W*22.05''H
- 👍️[𝐓𝐫𝐢𝐩𝐥𝐞 𝐅𝐢𝐫𝐞𝐩𝐫𝐨𝐨𝐟 𝐒𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 𝐰𝐢𝐭𝐡 𝐆𝐲𝐩𝐬𝐮𝐦 𝐁𝐨𝐚𝐫𝐝] Built with a 3-layer fireproof design, including a special fire-resistant insulation layer and gypsum board base that helps absorb heat and slow fire penetration. This advanced structure offers stronger fire protection than standard safes.
- 👏[𝐅𝐢𝐫𝐞𝐩𝐫𝐨𝐨𝐟 & 𝐌𝐨𝐢𝐬𝐭𝐮𝐫𝐞-𝐑𝐞𝐬𝐢𝐬𝐭𝐚𝐧𝐭 𝐈𝐧𝐭𝐞𝐫𝐢𝐨𝐫] Inside the safe is a special protective material that helps guard against heat and moisture, making it ideal for storing electronics, hard drives, memory cards, and important documents without worrying about humidity damage.
- ✔️[𝐀𝐧𝐭𝐢-𝐓𝐡𝐞𝐟𝐭 𝐀𝐥𝐚𝐫𝐦 & 𝐖𝐚𝐥𝐥-𝐌𝐨𝐮𝐧𝐭 𝐃𝐞𝐬𝐢𝐠𝐧] For added security, this home security safe features a built-in alarm system that sounds if the wrong code is entered multiple times. The safe can also be securely mounted to the wall, helping prevent theft or unauthorized removal.
- 💪[𝐇𝐞𝐚𝐯𝐢𝐞𝐫 & 𝐒𝐭𝐫𝐨𝐧𝐠𝐞𝐫 – 44𝐋𝐁 𝐒𝐨𝐥𝐢𝐝 𝐁𝐮𝐢𝐥𝐝] At 44 pounds, this small safe is significantly heavier than many similar-size safes on the market that weigh only around 20lbs. The added weight and reinforced structure provide greater durability, stability, and security for your valuables.
Which storage option is right for my situation?
The best plan combines a digital copy for fast searching with a physically separate copy for resilience. The trade-off is not simply convenience versus security; it is confidentiality, availability when your phone is missing, resistance to physical hazards, portability, and the recovery features supported by the service.
| Option | Strength | Main risk or limitation | Best use |
|---|---|---|---|
| Secure password-manager note | Encrypted, searchable, and available across devices when the vault is accessible (NIST; GitHub) | Loss or compromise of the vault, or an unfamiliar manager-recovery process | Primary digital copy |
| Printed or handwritten copy in a locked, fire-resistant safe | Works when the phone and internet are unavailable; physically separate from digital devices (NIST; U.S. House cybersecurity handbook) | The paper can be stolen, burned, soaked, or discovered; Login.gov considers paper codes more vulnerable to theft and phishing | Offline resilience copy |
| Authenticator-app backup | Can restore eligible time-based accounts after device loss | Coverage varies; Microsoft Authenticator excludes work or school credentials from backup and cannot restore a backup between iOS and Android | Supplement to recovery codes |
| Security key | A separate possession factor; supported as a recovery method by services such as GitHub, with purchasable keys described by the NCSC | It can be lost or damaged, and supported features differ by service | Additional recovery method |
Do not choose only one row. A password-manager note is convenient but depends on access to the vault; paper is independent of batteries and networks but needs physical protection. An authenticator backup or security key adds another route, not a reason to discard the codes.
Recommended Free Tools
Can I save backup codes in a password manager?
Yes. A password manager is an appropriate primary location when the note is inside an encrypted vault and you have a tested way to recover the vault. GitHub recommends this practice, and NIST identifies encrypted password-manager storage as a security and usability improvement.
Set up the note securely
- Use the manager’s protected or encrypted-note feature, not a plain-text field visible in search results or browser history.
- Label the note with the account and service, then include the generation date so an old set can be recognized.
- Store the codes exactly as issued, preserving leading zeros, hyphens, and line breaks.
- Protect the vault with a long, unique primary password and the manager’s strongest available sign-in options.
- Understand emergency-access and account-recovery settings before you need them; a recovery process that automatically exposes the vault to an untrusted person is a risk.
Do not put the password-manager’s own recovery key and every account’s backup codes in a single unprotected file. If you keep a written recovery instruction for the vault, store it separately from the account-code sheet and restrict who can see it.
Should I print my Google, GitHub, or Microsoft backup codes?
Printing is sensible as a second, offline copy, but the exact behavior depends on the provider. Print or handwrite the current set, secure it physically, and regenerate it when the provider says a new set invalidates the old one. Never assume that a code count, backup feature, or recovery screen works the same way across services.
Google accounts
Google advises making recovery codes current before switching phones and recommends storing them in a safe location such as a password manager or a safety-deposit box. Before you retire a phone, sign in to the account’s 2FA settings, generate or refresh the codes, and verify that the new copy is in both storage locations.
GitHub
GitHub documents 16 recovery codes, instructs users not to share them, and recommends a secure password manager. Creating a new set invalidates every code from the prior set. After regenerating, replace the password-manager note and the paper sheet rather than keeping both generations.
Microsoft accounts and Authenticator
Microsoft Authenticator backup can help restore eligible authenticator accounts, but its documented limits matter: work and school credentials are excluded, and a backup cannot be restored across iOS and Android. Keep independent recovery codes and another enrolled method for accounts affected by those limits.
Rank #3
- FIREPROOF: Box is UL Classified to endure 1/2 hour at 1550°F to protect irreplaceable documents and valuables from fire and is ETL verified to protect CDs, DVDs, and USBs
- KEYLOCK: Fireproof safe features a flat key lock to prevent the lid from opening in the event of a fire; Includes 2 keys
- COLOR: The fireproof file box for documents has a black exterior finish
- MEASUREMENTS: Exterior is 15.3 inch W x 12.1 inch D x 13.6 inch H and the interior is 12 inch W x 8.5 inch D x 10.4 inch H, Large capacity 0.61 cubic feet
- DOCUMENT STORAGE: Document safe accommodates letter-size hanging files for easy storage of passports, social security cards, and birth certificates (sold separately)
Login.gov
Login.gov currently generates ten backup codes, and each may be used only once. The service warns that printed or written codes are more exposed to theft and phishing, so keep the paper under your control and do not carry the entire set loosely in a wallet or bag.
What happens if I lose my phone with two-factor authentication?
A lost phone does not automatically lock you out if you prepared another factor. First secure the phone and cellular account, then use a stored recovery code, a registered security key, an authenticator backup that covers the account, or another method offered by the service.
- Block or erase the device. Use your mobile-platform device-management tools to lock or erase the phone, and ask your carrier to suspend a lost SIM or transfer the number only after identity checks.
- Use one stored recovery path. Retrieve a single unused code from the password manager or safe, or use your security key. Enter it only on the genuine service sign-in page, not in response to an unsolicited message.
- Re-establish your normal factor. Enroll a replacement authenticator or security key, then remove the lost device from the account’s list of trusted or signed-in devices.
- Regenerate codes. Once you have regained access, generate a new set so any code that might have been copied with the phone is invalid.
- Review account activity. Check recent sign-ins, security alerts, recovery email and phone numbers, and authorized applications. Change the account password if the phone or its unlock method may have been accessible.
If you have no remaining factor, use the provider’s official account-recovery process. Recovery may require identity or ownership evidence and can take longer than entering a code; do not pay an unsolicited caller or message claiming to restore access.
How should I prepare before changing phones?
Prepare while the old phone still works. Google specifically advises updating recovery codes before a phone change, and the same principle applies to any service that relies on an authenticator.
- Open each important account’s security page and confirm that recovery codes are current.
- Check that the codes appear in your password-manager note and that the physical copy matches the newest generation.
- Enroll the new authenticator or security key before wiping the old phone.
- Confirm that at least one alternate factor works on the new device.
- Only then remove the old authenticator, erase the old phone, and regenerate codes if the service’s transfer process requires it.
Do not rely on an authenticator backup without checking its scope. Microsoft Authenticator’s documented exclusions for work or school accounts and its operating-system restriction mean that a phone migration can leave some accounts without a restored factor.
When should I regenerate my backup codes?
Regenerate the complete set immediately after using a code, when the list is exhausted, when a copy may have been photographed or read, or when the service reports suspicious activity. Also regenerate after a change in household, workplace, storage location, or trusted helper that could have exposed the paper copy.
Some services invalidate old codes automatically when a new set is created; GitHub explicitly does. Other services may display a warning or use different terminology. Follow the provider’s current instructions, then update both storage copies and securely destroy the obsolete paper. Shred it rather than placing an intact list in household recycling.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can I test my recovery plan safely?
Test access to the storage, not the code itself. A code is single-use, so spending one merely to confirm that the list works reduces your emergency capacity.
Rank #4
- FIREPROOF: The safe is UL Classified to endure 1 hour at 1700°F and keep interior temperatures safe for irreplaceable documents, valuables, DVDs, and USBs
- WATERPROOF: The home safe is ETL Verified for 24 hours of protection in water up to 8 inches deep offering peace of mind in the event of a flood
- MAXIMUM SECURITY: Combination safe features 4 live-locking bolts, steel construction, pry-resistant hinge bar, shelf, and bolt-down hardware
- FALL RESISTANT: The safe box is ETL verified to withstand a 15-foot fall during a fire and remain closed
- MEASUREMENTS: Exterior:16.3 inch W x 19.3 inch D x 17.8 inch H; Interior: 12.6 inch W x 11.9 inch D x 13.8 inch H; Large 1.23 cubic foot capacity; Weights: 86 pounds
- Unlock the password manager from a second trusted device or its approved offline mode.
- Locate the exact account note and confirm that the generation date is current.
- Physically locate the paper copy and inspect the safe, lock, and paper condition.
- Verify that a security key, alternate authenticator, or other method is enrolled and recognized by the service.
- Review the provider’s sign-in and recovery pages for changed labels, code counts, or eligibility rules.
- After a real recovery, record which code was used and rotate the entire set.
Schedule a review whenever you change phones, reset a password, move the safe, change password managers, or receive a security alert. Service interfaces and recovery features can change, so rely on the provider’s current help guidance at the moment of a change.
What mistakes put backup codes at risk?
- Keeping only a screenshot. A photo library may synchronize to multiple devices or cloud accounts and can be exposed through a stolen, unlocked phone.
- Emailing the codes to yourself. Mail is indexed, forwarded, retained on servers, and often protected by the same account-recovery chain you are trying to preserve.
- Storing every factor together. A wallet or phone case containing the phone, password, authenticator seed, and paper codes gives one theft event too much power.
- Sharing a code with support or a relative. Legitimate providers do not need an unused recovery code sent through chat or email. If someone asks for one, treat the request as phishing.
- Failing to rotate after exposure. A code that was viewed, copied, or used must be considered unavailable; create a new set.
- Assuming all authenticator backups are equivalent. Eligibility, operating-system support, and work-account restrictions vary by provider.
- Ignoring physical hazards. Paper can burn, fade, or be destroyed by water. A locked, fire-resistant container and a separate digital copy address different failure modes.
What does a robust recovery setup look like?
For each important account, aim for at least two independent recovery methods in addition to your password: current one-time codes, an encrypted password-manager copy, a protected offline copy, and either an authenticator backup or security key when the service supports it. GitHub recommends two or more authentication methods, while the NCSC describes security keys as an additional possession factor.
Independence matters. Two copies stored in the same cloud account are one failure domain; two sheets in the same desk drawer are one physical failure domain. A password-manager note plus a safe-held paper copy, supplemented by a security key or eligible authenticator backup, gives you options when one device, location, or service feature fails.
Keep the plan understandable to your future self. Record the service name, storage location, and last update date, but never write the actual account password beside the codes. Revisit the plan whenever a provider changes its recovery interface or whenever your devices, household, or trusted accounts change.
Frequently Asked Questions
How many backup codes should I keep for each account?
Keep the complete set issued by the service rather than selecting a subset. Providers choose different counts and may invalidate every older code when you generate a replacement, so preserve the whole current set in both storage locations.
Can I store recovery codes in a bank safe-deposit box?
A safe-deposit box can provide controlled offline storage, and Google lists one as an example of a safe location. Make sure you can access it when the institution is closed and still maintain a separate copy for emergencies at home.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Are backup codes safer than SMS verification?
They avoid dependence on cellular service and SIM delivery, but possession of an unused code is itself enough to authenticate. Login.gov therefore calls backup codes its least-secure 2FA option; protect them carefully and use stronger factors when available.
What should I do if someone saw one of my recovery codes?
Assume the exposed code is compromised and generate a new set from the account’s security settings. Replace the password-manager note and paper copy, review recent sign-ins, and remove any device or factor you do not recognize.
Can I give my partner or executor my backup codes?
Do not send codes through email, chat, or a support ticket. If another person must have emergency access, use a documented estate or household-access arrangement that controls the physical safe and password-manager recovery process without distributing individual codes casually.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
