Every time you turn on two-factor authentication, the same screen appears: "Save your backup codes somewhere safe." And almost everyone does the same thing — takes a screenshot, clicks download, and never thinks about it again. Those codes are the master override for your account: they exist precisely so that someone without your phone can get in. Which means where you keep them matters as much as the 2FA itself.
What Backup Codes Actually Are
It helps to be precise about what you are storing. Backup codes (also called recovery codes) are one-time-use strings a service generates when you enable two-factor authentication. Each code works exactly once, in place of the code from your authenticator app or SMS. They exist for one scenario: your second factor is gone — phone lost, broken, wiped, or an authenticator app that didn't survive a migration — and you need a way back in that doesn't depend on it.
Two properties follow from that design, and both matter for storage. First, backup codes are deliberately as powerful as your second factor: whoever holds them can complete a login without your phone. Second, they are static — unlike the rotating six-digit codes, they sit unchanged for years wherever you saved them, which is why a forgotten screenshot from 2021 is still a live credential today. Long-lived, powerful, rarely needed: that combination is what makes the storage question worth getting right.
Where Everyone Actually Puts Them (and Why Each Fails)
Backup codes end up wherever the path of least resistance leads. Each of the usual destinations undermines the protection 2FA was supposed to add:
- Screenshot in the camera roll: it syncs to your cloud photo library, appears when you hand someone your phone to show a picture, and sits on every device tied to your account. A compromise of your photo storage — or a lost, unlocked phone — exposes the exact codes designed to bypass your second factor.
- "backup-codes.txt" in the Downloads folder: it lives unencrypted on disk indefinitely, gets swept into cloud backups and file sync, and is trivially readable by any malware or by anyone who borrows the laptop.
- Emailed to yourself: this is the worst of all, because it collapses two factors into one. Anyone who breaks into your email now holds both the password-reset channel and the 2FA bypass for your other accounts.
- In your password manager: genuinely reasonable for many accounts — but circular for the accounts that protect the password manager itself, and it concentrates everything behind a single login. If the manager is locked, down, or lost, the codes meant to rescue you are locked inside it.
| Storage spot | The failure mode |
|---|---|
| Screenshot / camera roll | Synced everywhere, visible to anyone scrolling your photos, exposed by a photo-storage breach |
| Downloads folder | Plaintext on disk forever; readable by malware and swept into every backup |
| Email to self | One email breach yields both the reset channel and the 2FA bypass |
| Password manager | Circular for the accounts that guard the manager; single point of failure |
| Encrypted paper | Offline, unreadable if found; the remaining risk is losing the key or passphrase |
Why Paper Is the Right Medium for This Job
Backup codes have an unusual usage profile: you need them almost never, but when you do need them, it is often precisely because your digital world has failed — a phone lost or broken, an authenticator app gone with it, a password manager you cannot open. That profile is a perfect match for paper:
- No remote attack surface: a printed page cannot be phished, breached, or read by malware
- Independent of your devices: it works exactly when your phone does not
- No sync sprawl: a sheet of paper exists only where you put it
The catch is the same one paper always has: a plaintext printout of your backup codes is readable by anyone who finds it — and "somewhere safe" in most homes means a drawer. That is where encryption comes in.
Encrypted Paper: The Best of Both
With SecurePaper's 2FA backup codes use case, you paste your codes into your browser, they are encrypted locally with AES-256-GCM before anything is rendered, and you print the resulting code. The printout is useless to anyone without the key — so it can live in that drawer, in your desk at work, or in a folder of household paperwork without being a liability.
A few properties make this work particularly well for backup codes:
- One paper for many services: instead of a loose screenshot per account, put your email, bank, cloud storage, and social account codes into a single document — service name, account, and codes for each — and encrypt them together
- Passphrase mode stores nothing anywhere: choose a passphrase and the key is derived from it (via PBKDF2) only at decryption time — there is no key file, no account, and no server involved
- Cheap to refresh: when you use a code or regenerate a set, reprinting the updated document costs nothing, so the backup actually stays current
- Decryptable without the service: the offline decryptor is a standalone file that works even if SecurePaper itself is unreachable — details on the security page
A Practical Setup in Five Steps
The whole exercise takes about fifteen minutes:
- Collect: log into your most important accounts (email first — it resets everything else) and generate or view the backup codes for each
- Consolidate: put them into one document — service, account name, codes — rather than scattered files
- Encrypt: use the 2FA template, choose passphrase mode or a generated key, and let the encryption happen in your browser
- Print two copies: keep one at home and one somewhere else — a desk at work, a relative's house, a bag you travel with; encrypted copies are safe to distribute
- Clean up: delete the screenshots, the downloads, and the emails to yourself — the whole point is that plaintext copies stop existing
One Honest Caveat
Encryption moves your risk from "someone finds the paper" to "I lose the key." Take that seriously: if you use passphrase mode, pick a passphrase you will still remember in two years, and consider sharing it with a partner. If you use a generated key, export it as a JSON backup and keep that export separate from the printed codes. Codes you cannot decrypt are no better than codes you never saved. Our getting started guide covers key handling in more depth, and if you are weighing paper against other media more broadly, see Is It Safe to Write Passwords on Paper?
Conclusion
2FA backup codes are a bypass for your strongest security control, and they deserve better than a camera roll. Paper takes them offline; encryption makes the paper safe to keep anywhere. One encrypted page covering all your important services, printed twice and stored in two places, turns the account-lockout scenario from a crisis into a minor errand.
Consolidate Your Backup Codes Today
The 2FA backup codes template gives you a ready layout for service, account, and codes — encrypted in your browser, free, no account required.