Where to Store 2FA Backup Codes
Backup codes exist for the day your phone is lost, broken, or reset — but each code is also a one-time bypass of your two-factor authentication. They need to be somewhere you can reach without your phone, yet unreadable to everyone else. Encrypted paper does both.
The problem
When a service shows you backup codes, it shows them once. What most people do next creates one of two failure modes:
- Saved insecurely. A screenshot in the camera roll, a "codes.txt" in Downloads, an email to yourself. Every one of those copies is plaintext, synced to the cloud, and defeats the purpose of 2FA for anyone who gets into that account or device.
- Not saved at all. The dialog gets dismissed, and months later a lost phone turns into days or weeks of account-recovery forms — sometimes into permanently lost accounts.
A plaintext printout avoids the cloud problem but leaves the codes readable by anyone who opens the drawer. The missing piece is encryption before printing.
How it works with SecurePaper
- 1
Open the 2FA backup codes template
The template has fields for the service, the account, and a list of codes. Paste in the codes for one service — or repeat the block for several.
- 2
Encrypt in your browser
SecurePaper encrypts the text with AES-256-GCM locally, using WebCrypto — the codes never leave your device. Protect them with a random key or a passphrase you remember (see the security page for how each mode stores keys).
- 3
Print the QR codes
The encrypted output becomes one or more QR codes on a printable page. File it with your documents — the sheet reveals nothing about what it protects.
- 4
When you need a code, scan and decrypt
Scan the sheet with any camera-equipped device, enter your key or passphrase, and the codes decrypt in the browser — no phone with your authenticator app required.
Versus the usual storage places
Versus a password manager
A good password manager is a fine home for most backup codes, and it wins on convenience. Its blind spot is circularity: the codes for the manager itself, and for the email account that recovers it, must live outside the manager — otherwise a lockout locks you out of the recovery too. Encrypted paper is the natural out-of-band layer for exactly those codes.
Versus screenshots and cloud notes
Convenient, but plaintext codes in a synced account mean any compromise of that account switches off your second factor everywhere. Encrypted paper is offline and unreadable — there is no account to breach.
Versus a plaintext printout
A plain printout already beats cloud storage for this purpose — paper cannot be hacked remotely. Encryption fixes its one weakness: anyone with physical access can read it. The encrypted version costs the same sheet of paper.
Frequently asked questions
Should I just keep 2FA backup codes in my password manager?
For most accounts that is a reasonable choice. The exception is the password manager itself and the email account you would use to recover it: if their backup codes live inside the manager, you cannot reach them exactly when you are locked out. Those codes need a home outside the system they unlock — encrypted paper is a good one.
Is a printed QR code safe if someone finds the paper?
Yes. The QR codes contain only AES-256-GCM ciphertext. Without your key or passphrase, a finder sees random data — they cannot tell which service the codes belong to, let alone use them.
Can I put codes for several services on one sheet?
Yes. You can encrypt one document listing several services, or create a separate document per service. The template is a starting layout — add as many service/code blocks as you need before encrypting.
What if I lose my phone and cannot scan the QR codes?
Any device with a camera and a browser works — a family member's phone, a laptop with a webcam, or a borrowed tablet. Decryption runs in the browser on the SecurePaper decrypt page or in the standalone offline decryptor file, so you are not dependent on one specific device.
My codes changed after I regenerated them — what now?
Create a new encrypted document with the new codes, print it, and destroy the old sheet. If you saved your key (guest mode or an account), you can reuse the same key; with a passphrase you can simply use the same passphrase again.
Where should I store the printed sheet?
Anywhere you would keep an important document: a home safe, a locked drawer, a folder with your papers. Because the content is encrypted, the storage place does not have to be perfectly secure — a second copy at a relative's house adds resilience at no risk.
Get your backup codes out of the screenshots folder
It takes a few minutes, and the printed sheet works even when every device is gone.
Start from the 2FA backup codes template — free, no account neededSee the step-by-step guide, the security model, or our deeper comparison in where to keep 2FA backup codes.