Safest way to keep recovery codes off one device
Keep backup codes offline in two separate secure locations—for example, encrypted removable media and a locked paper copy.
What to do next
- Keep backup codes offline in two separate secure locations—for example, encrypted removable media and a locked paper copy.
- Avoid storing the only copy on the device used for sign-in, and do not email the codes to yourself unencrypted.
- A hardware security key adds recovery options but does not replace safely stored one-time backup codes.
Recommended service or product
YubiKey security keys
YubiKey security keys is a relevant starting point for this task because it offers the official service, tool or product category used in the steps above.
Open YubiKey security keys — official websiteWhat to check before deciding
Avoid storing the only copy on the device used for sign-in, and do not email the codes to yourself unencrypted. A hardware security key adds recovery options but does not replace safely stored one-time backup codes. A hardware security key protects logins but does not replace storing backup codes. Keep at least two independently protected recovery methods.
Frequently asked questions
Which details are most important for safest way to keep recovery codes off one device?
Keep backup codes offline in two separate secure locations—for example, encrypted removable media and a locked paper copy.
Which alternative is worth considering for safest way to keep recovery codes off one device?
Avoid storing the only copy on the device used for sign-in, and do not email the codes to yourself unencrypted.
Which details are most important for safest way to keep recovery codes off one device (part 3)?
A hardware security key adds recovery options but does not replace safely stored one-time backup codes.
What should readers understand about safest way to keep recovery codes off one device?
Offline backup codes should be stored in separate protected locations; sharing ephemeral secret is not backup storage.