Question What’s the best place to securely store my 2FA recovery codes for my accounts?

[lokamoka820]

Hi everyone,

I've been in the process of switching my email addresses on various accounts to aliases (based on what we talked about in a previous thread) for better privacy. While doing this, I nearly deleted my old primary email credentials — which, it turns out, also hold the 2FA recovery codes for several important accounts.

Before I proceed further, I want to make sure I'm handling these recovery codes safely, so my question is: What's the best practice for storing 2FA recovery codes securely?

I'd appreciate any recommendations. Thanks in advance!

 

[Dave Russo]

I would consider writing them down in a notebook

 

[Marko :)]

Personally, I save them in my cloud storage (Filen.io & Google Drive). What's the logic here? They are just regular text files with random codes. Even if someone magically gains access to these text files, they can't do much considering they'd also need to know exact username or e-mail address associated to account.

For even better protection, you can put text files with codes into password-protected archive and then upload them to cloud as well.

 

[Jonny Quest]

Personally, I save them in my cloud storage (Filen.io & Google Drive). What's the logic here? They are just regular text files with random codes. Even if someone magically gains access to these text files, they can't do much considering they'd also need to know exact username or e-mail address associated to account.

For even better protection, you can put text files with codes into password-protected archive and then upload them to cloud as well.

It's where my 2FAS is synced to, my Google Dive account.

 

[RoboMan]

I store them as secure notes in my password manager

 

[lokamoka820]

Personally, I save them in my cloud storage (Filen.io & Google Drive). What's the logic here? They are just regular text files with random codes. Even if someone magically gains access to these text files, they can't do much considering they'd also need to know exact username or e-mail address associated to account.

For even better protection, you can put text files with codes into password-protected archive and then upload them to cloud as well.

But how will you know which code corresponds to which account if the text files only contain random codes without any reference to the accounts they belong to?

I store them as secure notes in my password manager

At least you won’t accidentally delete them like I did when changing the email or password of the accounts.

 

[Wrecker4923]

What's the best practice for storing 2FA recovery codes securely?

Definitely, store them independently of your passwords and your primary email accounts (which can be used to reset the passwords). Getting access to one of these shouldn't allow access to your 2FA (the recovery codes) as well.

For safety, store the recovery codes independently of your 2FA authenticator as well, because if you lose access to the authenticator, you shouldn't lose access to the recovery codes.

Ideas that people have come up with for where to store them:

• Offline password manager, with the database stored on a USB drive that's only occasionally connected.
• In an encrypted volume/file (VeraCrypt, 7z, etc.)
• Pieces of paper (hard to back up)

Whatever the storage scheme is, use the 3-2-1 backup scheme, and store the storage passwords (if applicable) independently of or redundantly in your password managers.

 

[Sunshine-boy]

What I do personallyis just zip the codes up and upload them to my Telegram Saved Messages. I find it to be very secure and super convenient. Since Telegram is synced, you can always get to your codes from any device if you ever get locked out. Just make sure you put a strong password on the ZIP file before you upload it so it's encrypted.

 

[Marko :)]

But how will you know which code corresponds to which account if the text files only contain random codes without any reference to the accounts they belong to?

I have one account per site, so it's not really an issue for me. If it happens that I have more accounts on the same site, I'll just separate accounts by putting "primary", "secondary" account in the name.

 

[lokamoka820]

What I do personallyis just zip the codes up and upload them to my Telegram Saved Messages. I find it to be very secure and super convenient. Since Telegram is synced, you can always get to your codes from any device if you ever get locked out. Just make sure you put a strong password on the ZIP file before you upload it so it's encrypted.

There’s no like button on your post, so

 

[Sorrento]

Text files on a USB kept in my underpants, they will be safe there

 

[SHvFl]

I encrypt them and store them online at 2 places. I also keep 2 offline backups (1 encrypted and 1 unencrypted) just in case.

 

[TairikuOkami]

Definitely, store them independently of your passwords and your primary email accounts

Indeed, a backup should be accessible without relying solely on online account.

1. A hacker tries to access your account, so you will be logged out of all devices as a security precaution.
2. You need to use password manager, which uses OAuth 2.0 or email as 2FA, but do not have access to either.
3. You will try to access your cloud, with backup keys, but it is already logged out, also using OAuth 2.0 or email.

 

[anirbandutta01]

Secure notes in password manager & write down in a notebook.