Where to keep 2FA backup codes so a lost phone won’t lock you out

What backup codes are for

Two-factor sign-in adds a second step after your password: a code from an app, a text message or a key. Backup codes are the way in when that second step is gone, because the phone was lost, broken, wiped or replaced. Most services show them once, when you turn on two-factor sign-in, and expect you to save them.

So the one rule follows from their job: they must survive the loss of the phone.

The mistake most people make

Many people put the backup codes in the same place as the live codes: a screenshot on the same phone, a note on the same phone, or the same authenticator app. When the phone goes, the live codes and the backup codes go together.

A second mistake is the camera roll. A screenshot of backup codes is saved to your photo library and often synced to every device on your account. Screenshots are saved to your photo library automatically.

A plan that works

1. Save the codes the moment you see them. Download or copy them before you close the page.
2. Print or write them on paper. Label each sheet with the service and the date. Keep it with your passport or other papers.
3. Keep a second copy with its own lock, away from the authenticator. A vault app that backs up to your own cloud works, and so does a password manager on a different account.
4. Delete stray copies: the downloaded file in Files, the screenshot, the email draft.
5. Cross off codes you use. Each one usually works once.
6. When you make new codes, the old ones stop working. Replace both copies.

Where the live codes should live

Sign-in codes themselves are a different job: you need them often, so they belong somewhere quick. The Passwords app on iPhone can generate them from a QR code or a setup key and fill them in for you (iPhone User Guide). Many people use a separate authenticator app instead.

Whichever you choose, keep the setup key or QR code that created each one in the same safe place as the backup codes. With it, you can rebuild the live codes on a new phone. The Passwords app and vault records, compared sets the two homes side by side.

Your Apple Account is its own case

Apple’s two-factor sign-in uses trusted devices and trusted phone numbers rather than printed codes. Apple says adding another trusted phone number helps if you can’t reach the first one (iPhone User Guide). If you turned on a recovery key for the account, Apple says it can’t give it back if you lose it (Apple Support), so it belongs on paper too. What a recovery key is covers that.

Keeping them in Sealed

Records keep logins, 2FA codes, credit cards, bank accounts, IDs and passports, Wi-Fi networks, recovery codes, license keys, contacts and custom fields. Records are part of Sealed Pro.

In a record, sensitive fields such as a document number stay masked until you tap Reveal Values and confirm with Face ID or your device passcode, and they mask themselves again after 30 seconds. Names, notes and the fields of a record are sealed with your vault key too, not just the photos.

Backup carries your photos, videos and documents, your stacks, your notes and your records. Files, names, notes and record fields are encrypted on your iPhone before they are uploaded, so iCloud receives only ciphertext. To open that backup on a new phone, you need your Sealed recovery key, which is why it goes on paper with the rest. The recovery key is the only way to decrypt an iCloud backup on a new iPhone.

Where Sealed helps, and where it doesn’t

It helps keep backup codes and setup keys behind a second lock, encrypted, with a backup. Names, notes and the fields of a record are sealed with your vault key too, not just the photos. Files, names, notes and record fields are encrypted on your iPhone before they are uploaded, so iCloud receives only ciphertext.

It helps with live codes too, if you want them in one place. 2FA codes stay live in the vault and are ready to copy.

It doesn’t fill codes into websites for you. 2FA codes stay live in the vault and are ready to copy.

It doesn’t help on a new phone without the recovery key. The recovery key is the only way to decrypt an iCloud backup on a new iPhone.

It doesn’t keep records on the free plan. On the free plan you can add photos. Videos, documents, notes and records need Sealed Pro.