Backup codes are the spare key. They're what gets you into your accounts when the lost-phone day arrives, when your authenticator app gets reset, or when your spouse needs to log into the household Netflix account without your phone in the room.
They are also one of the most-mishandled artifacts in personal security. Too many people screenshot them and forget where the screenshot lives. A surprising number leave them in the email inbox where they were originally generated. Some people memorize them once, lose the printed copy, and end up locked out anyway.
This guide covers where to store backup codes so they're there when you need them, where not to store them, and why they belong in a different field from your TOTP secret.
What backup codes are, exactly
When you turn on two-factor authentication (2FA) on a service like Google, GitHub, your bank, or your email, you typically get two things:
- A TOTP secret. This is the seed value that your authenticator app uses to generate the rolling 6-digit codes you see when you log in. The seed itself is set up once (often by scanning a QR code) and used invisibly thereafter to produce a new code every 30 seconds.
- Backup codes. Usually 8 to 10 single-use codes (often 8 digits each), printed on a recovery page during 2FA setup. Each one is good for exactly one login if you've lost access to your authenticator app.
These two things solve the same problem (proving you're you) through different mechanisms, and they're easy to confuse. Treating them as interchangeable is one of the most common mistakes in 2FA hygiene.
A TOTP secret never gets used up. It produces a new code every 30 seconds, forever. If you have the secret, you have ongoing access. If a TOTP secret is exposed, you lose your second factor, because anyone with the secret can produce the same codes you can.
Backup codes are single-use. Once a code is used, it's invalidated. The full set is your fallback. If you lose access to your authenticator app and your backup codes, you're locked out and have to go through the service's account recovery flow, which usually takes days, sometimes weeks, and sometimes never resolves at all.
The asymmetry matters: the TOTP secret needs to stay carefully hidden, while the backup codes need to be reachable in an emergency. The two have different storage needs and, really, different threat models.
Why backup codes need a different home than your TOTP secret
If you store both your TOTP secret and your backup codes inside your authenticator app, you've collapsed the redundancy: lose the phone and you lose access to both. Backup codes are meant to be the fallback for when the authenticator app is unavailable, so they cannot live inside the very thing they're backing up.
The same logic applies in reverse. If you store both inside a single password-manager field labeled "2FA notes," you lose the distinction. Some apps only let you reach that field by unlocking the manager, which is fine until the day you can't unlock it: a forgotten master password, a failed fingerprint scan, a dead phone. At that moment, the backup codes don't help.
The pattern that works looks like this:
- The TOTP secret lives with the credential, ideally in a structured field tied to it, encrypted at rest, reachable only with your master password or biometric.
- The backup codes live with that same credential but in a separate structured field, so an emergency view, a print export, or a trusted person can reach them without exposing your TOTP secret.
- A second copy of the backup codes lives outside the password manager entirely: printed in a fireproof box, sealed in an envelope in your filing cabinet, or tucked inside an encrypted backup file kept somewhere else.
In v3.0.0, SecureKeep's structured 2FA does exactly this. Each credential has a TOTP Secret field and a Backup Codes field, both masked, both encrypted, and both visible to whoever holds the vault, but kept separate. They're two different artifacts, and they finally have two different homes.
What good storage looks like, and what to avoid
The best home is the one that keeps a copy reachable through your password manager and a second copy somewhere physical. In practice that means storing the codes in a structured Backup Codes field on the credential, encrypted at rest and reachable with your master password or biometric, and then keeping a printed copy somewhere out of band: a fireproof box, a sealed and clearly labelled envelope, or an envelope left with a trusted person who opens it only in a real emergency. An encrypted backup file of your whole vault, stored away from your phone (a fireproof safe, a USB stick at a sibling's house, a cloud-drive folder you trust), covers the same ground, since it contains the backup codes along with everything else.
A couple of options are fine if a little clumsier. A secure note in your password manager works, as long as it's a different field from the TOTP secret. A photograph of the printout, kept in your manager's encrypted document section, works too, though you'll have to read the codes off the image instead of pasting them.
What to avoid is anything that leaves the codes sitting in plaintext or in a place that syncs and indexes on your behalf. A screenshot in your phone's Photos app is the common one: it isn't encrypted the way most people assume, it's indexed and synced to the cloud, and it can surface in a shared album by accident. The email inbox where the recovery message first arrived is another, because a breach of that account exposes every code you've ever been sent. The same goes for a Google Doc, a Notion page, a Dropbox file, or a text file on your desktop, none of which were built to hold credentials. Memorizing the codes doesn't work either: they're single-use and regenerate whenever you reset 2FA. And the one place they must never live is inside the same authenticator app that generates your TOTP code, which collapses the very redundancy they exist to provide.
How to share backup codes with your spouse
This is the part most articles skip. Backup codes protect more than your own future self; they protect the people who will need to log in on your behalf.
Here's the household pattern that works:
- Each adult has their own vault on a shared family device. SecureKeep's multi-vault model is built for this. One iPhone or Android phone can hold your spouse's vault, your parent's vault, and your own, each with its own master password and its own content.
- Each vault holds its credentials with structured TOTP secrets and backup codes. Both fields are encrypted and masked, and either spouse can reach them by unlocking the right vault on the shared device.
- The trusted person knows where the device is and the master password to their vault. This usually gets communicated on a physical Emergency Card export: printed, sealed, and stored somewhere safe. The card itself holds no backup codes, but it documents how to reach them.
- A printed copy of the highest-priority codes gets refreshed once a year. Email, banking, and the password manager itself go into a fireproof box at home, kept out of band, with an annual calendar reminder to update them.
No single mechanism here is perfect. What makes it work for a household is the combination: redundancy, a bit of structure, and a clear handoff to the person who'll need it.
A few account-specific notes
Email. Your email is the single highest-value account in your digital life, since it's the password-reset path for everything else. Generate backup codes for it specifically, and store them both in your password manager and on paper in a fireproof box. If you do this for only one account, do it for email.
Bank accounts. Most banks generate backup codes during 2FA setup. Some banks (especially in the US and UK) also send an SMS code as a fallback. That feels safer, but SMS-based 2FA is vulnerable to SIM-swapping attacks, so where you can, prefer authenticator-app 2FA backed by stored backup codes.
Password manager itself. This is the meta case. If your password manager has 2FA enabled (1Password, Bitwarden, and LastPass all support it), its backup codes cannot live inside the manager. Print them and put them in the fireproof box.
Government services. Some government 2FA setups don't issue backup codes at all; recovery means calling a phone line instead. Document that recovery number in your password manager so it's reachable when you need it.
A field-level walkthrough in SecureKeep
In v3.0.0, when you add or edit a credential in SecureKeep, the 2FA section has two structured fields:
- TOTP Secret: the seed value (typically a long base32 string, or scanned from a QR code). Masked when displayed.
- Backup Codes: a multiline field for the recovery codes you saved when 2FA was set up. Masked when displayed.
Both are encrypted with the vault's data encryption key (AES-256-GCM) before being written to disk. Both are reachable only after master-password or biometric unlock. The two fields are deliberately separate so that a future export, an emergency view, or a trusted-person handoff can surface backup codes without revealing the TOTP secret, and vice versa.
If you have credentials from earlier versions of SecureKeep where 2FA information was stored in a single twoFactorInfo field, the v3.0.0 migration moves that content into the Backup Codes field on first edit. The migration is one-way and conservative: your data is preserved, just moved to where the structured model expects it.
Frequently asked questions
Are backup codes encrypted in SecureKeep? Yes. Backup codes are stored in a structured field on the credential, encrypted with the vault's per-vault data encryption key (AES-256-GCM) before being written to disk.
Can I print my backup codes from inside SecureKeep? Not directly today. The Emergency Card export is the closest equivalent: you can document where the codes live and how to reach them on the printed card without printing the codes themselves.
What happens to my old twoFactorInfo data? v3.0.0 migrates legacy twoFactorInfo content into the new Backup Codes field on the first edit of each affected credential. The migration is conservative; the original content is preserved.
If I lose my phone AND my paper copy of backup codes, am I done? Through your password manager: not necessarily, if you have an encrypted backup file stored elsewhere (cloud drive, USB stick, with a trusted person). Restore the backup, retrieve the codes. If both the device and all backup paths are gone, you'll fall back to each service's account-recovery flow, which is usually slow but not impossible.
Should I store TOTP secrets and backup codes in two different password managers? Generally no. Splitting your second factor across two managers creates more failure modes, not fewer. Better to use one password manager with structured fields, plus an out-of-band paper copy of the highest-priority codes (email, banking).
What about Yubikey or hardware security keys? Hardware keys replace TOTP for many services. If you use a hardware key, your backup codes serve as the fallback if the key is lost. SecureKeep doesn't manage hardware keys directly, but you'd still store their associated backup codes in your vault.
My service uses SMS-based 2FA. Where do I store anything? SMS doesn't have backup codes the way authenticator-app 2FA does; the fallback is the SIM card itself. Better practice: switch the service to authenticator-app 2FA where it's offered, then generate backup codes from there.
Related reading: