Create offline copies only
Generate backup codes through your account security settings while 2-Step Verification is already enabled. Google provides a set of ten 8-digit codes that you can print or download as a text file named Backup-codes-username.txt.
Immediately move the printed sheet or USB drive to a secure physical location such as a locked drawer or safe. Avoid photographing the codes or saving them to any device that syncs to the cloud. Login.gov notes that printed codes are the least secure MFA option precisely because they can be stolen or copied if left accessible.
If you must keep a digital copy, encrypt the file with a strong passphrase and store it on removable media that stays disconnected from networks. Search your computer only if you lose the printed version; the file name follows the pattern Backup-codes-username.txt.
Define strict access boundaries
Limit physical access to the printed codes to yourself and, at most, one trusted person who knows the storage location. Do not place copies in shared household areas or with family members who might need them without your knowledge.
Never email codes, store them in shared documents, or upload them to any service. Google explicitly states it will never ask for a backup code except during sign-in, so any request outside that context is a social-engineering attempt.
For organization administrators, generate codes only when a user is locked out and deliver them through a secure channel such as an in-person handoff or encrypted message that expires. Store the generated list only long enough to deliver it, then delete the copy.
Replace codes on a schedule
Each backup code works only once. After using one, mark it used on the printed sheet. When the last code is consumed or you suspect theft, immediately generate a fresh set through account settings. The old set becomes inactive automatically.
Create a new set whenever you change phones, reset an authenticator app, or suspect any compromise. Google allows you to refresh codes at any time; the previous list is invalidated the moment the new list is created.
Keep the replacement process simple: sign in with an active code or another factor, navigate to security settings, and select the option to get or refresh backup codes. Print or download the new list and destroy the old printed sheet.
Test recovery before you need it
Schedule an annual test: sign out of all sessions, attempt sign-in using only a backup code, and confirm you reach the account. This verifies that the printed codes still work and that no service changes have invalidated the recovery path.
During testing, note the exact steps required by each service. Some providers ask you to click “Try another way” and then enter an 8-digit code; others present the option directly. Document the sequence so you can repeat it under stress.
If the test fails, regenerate codes immediately while you still have access. Do not wait until an actual lockout occurs. Administrators can generate codes for users through the admin console when 2-Step Verification enforcement is active.
Understand the limits
Backup codes are a convenience, not a complete recovery plan. They do not replace keeping recovery phone numbers and email addresses current. If an attacker obtains both your password and a printed code list, they can take over the account.
Services may change code format or delivery methods over time. Relying solely on one printed sheet without periodic checks leaves you exposed to policy updates. Combine backup codes with hardware security keys or multiple authenticator apps when possible.
Finally, treat every code as a high-value secret. Once used or replaced, destroy the physical copy so it cannot be recovered from trash or found by others.