The Right Way to Send Recovery Codes and 2FA Backups

Why recovery codes deserve “ultra care”

Recovery codes bypass your 2FA when you can’t access the authenticator or key. Treat them as “master keys.” If one leaks, attackers can skip MFA—and you may not notice until it’s too late.

Generate and store them safely

• Generate fresh codes from the service’s security settings and store them as a secure note in your password manager.
• Keep an offline copy (paper in a lockbox or a secure USB) for emergencies.
• Don’t screenshot codes into photo libraries that sync to the cloud.

If you must share a code (rare, short-lived)

• One-time, expiring delivery with an access code. How-to: The Safe Way to Share Passwords in 2025 (No Email).
• Split channels (link in email/chat; access code by SMS/call) and verify identity first. Link safety tips: Verify Links Like a Pro.
• Rotate afterwards—regenerate codes once used or after sharing.

Better than sharing: redundancy

• Two authenticators enrolled to the same account (e.g., phone + tablet), each protected by a strong passphrase. Build one: Create Strong Passphrases.
• Security keys (two FIDO2 keys) kept separately; register both, label them, and store one off-site.
• Team scenario: Use role-based accounts and group recovery processes rather than passing single-user codes around.

Quick playbook

• Step 1: Generate codes → save in manager → print/store offline.
• Step 2: If sharing is unavoidable → one-time link + access code via different channel.
• Step 3: Verify identity → recipient uses once → you regenerate codes.
• Step 4: Document where codes live and who has access.

What if codes leaked?

• Revoke sessions and change password immediately.
• Regenerate recovery codes and re-enroll 2FA if needed.
• Follow this incident plan: The Simple Incident Playbook for Leaked Passwords.

FAQ

Are recovery codes safer in a password manager or on paper?
Both can work. Managers provide convenience and encryption; paper avoids cloud exposure if stored well. Many people use both.

Should I email recovery codes to myself “for later”?
No. Email creates long-lived archives. Use a manager or offline copy instead.

Related reading

Zero-knowledge delivery: The Beginner’s Guide to Zero-Knowledge Sharing

Phishing-safe habits: Verify Links Like a Pro

Password hygiene & strength: How to Create Strong Passphrases You’ll Actually Remember

Bottom line

Treat recovery codes like a spare master key: store them smartly, avoid sharing, and if you ever must share—use one-time, expiring delivery and rotate immediately.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.