Where to store 2FA recovery codes
Keep recovery codes in a password manager and keep a printed copy somewhere physical, such as a locked drawer. A Vault can hold a scan or a text file of them, but StrongRoom has no cloud copy, so never make it the only copy. A vault is the offline copy on the phone, not the only copy.
What recovery codes are for
When a site sets up two-factor sign-in, it often gives a list of one-time codes. They are the way back in if you lose the phone that generates your normal codes. That makes them as sensitive as a password, and they are often needed at the worst moment: a lost or broken phone.
The trap: storing them where you need the account to read them
Apple's advice for the Apple Account recovery key shows the rule. Apple says to keep it in a safe place, to consider more than one place, to print it or write it down, and not to keep it in Passwords, iCloud Photos, Notes or iCloud Drive, because you could not open those if you lost access to the account. Apple also says it cannot provide you with the key if you lose it. Apply the same thinking to other accounts: a code stored only in the account it unlocks, or only on the phone you may lose, is not a recovery plan.
Three layers that work together
- A password manager. Apple's Passwords app can create and hold verification codes for two-factor sign-in, and set-up works by scanning the site's QR code or entering the setup key. That is for everyday codes. Store the list of recovery codes beside the account entry if your manager supports it, and make sure the manager itself can be recovered.
- A printed copy. Print the codes, or write them down, and keep the page apart from the phone. A locked drawer or a safe is fine. This is the copy that survives a dead phone.
- An encrypted scan in a Vault. A Vault on the phone keeps a copy private from anyone who borrows the phone. Import the codes as a file or a scan, and put them in a folder called Accounts. This is a convenience copy.
What a Vault cannot do here
StrongRoom keeps nothing in the cloud and cannot restore a Vault for you. If the phone is lost and you have no Export Package and no Recovery Phrase, the codes in it are gone. That is why it must not be the only copy. Make an Export Package now and then and keep the file away from the phone.
Habits that help
- When a site issues new codes, replace the old list in every place at once and destroy the old print.
- Do not photograph codes into your camera roll, and do not send them to yourself in chat.
- Note which account each list belongs to, but not the account's password.
- Folders in a Vault
- Export Package
- Back to the pillar guide
- Seed phrases
- What happens if I lose my phone
- What StrongRoom does not protect against
Frequently asked questions
Is a password manager enough for recovery codes?
It is a good main place, but add a printed copy, because you may need the codes when you cannot reach the manager.
Can I keep recovery codes in Notes?
Apple tells people not to keep the Apple Account recovery key in Notes, Passwords, iCloud Photos or iCloud Drive. For other accounts, ask whether you could open the note if you lost the account.
Is a Vault a safe place for them?
It keeps a copy private on the phone. It is not a second site; it does not copy itself anywhere, so keep another copy.
Sources
- Set up a recovery key for your Apple Account (Apple Support), checked on 2026-10-30.
- Use the Passwords app to create, manage, and share passwords and passkeys across Apple devices (Apple Support), checked on 2026-10-30.
- Automatically fill in one-time verification codes on iPhone (Apple Support), checked on 2026-10-30.