Differences in Service Recommendations

After enabling two-factor authentication, users receive a list of 10 backup codes along with instructions to store them securely. However, different platforms have varying approaches to the security of these codes. For example, some services like Microsoft advise against keeping the codes on the device used to access the account. Meanwhile, Instagram suggests saving the codes to the clipboard, taking a screenshot, or using another method to ensure access if needed. As a result, storage instructions can even be contradictory for the same device.

How Popular Services Handle Backup Code Storage

• Google recommends printing or downloading backup codes and advises storing them in a safe place, such as alongside your passport or other important documents. Storing the file on your device is also permitted, as indicated by their suggestion to search for a file with a specific name if the codes are lost.

• Apple advises against saving the 28-character recovery key in apps like "Passwords," iCloud Photos, "Notes," or iCloud Drive, since these apps may be inaccessible if you lose account access.

• GitHub suggests using a password manager to store codes and provides a button to download them.

• Dropbox requires confirmation that codes are stored in a secure location but does not specify what qualifies as such.

• Facebook recommends printing or writing down the codes by hand.

• Amazon does not mention backup codes on its support pages.

Only Microsoft and Apple explicitly state where you should not store your codes. Instagram suggests using the clipboard or taking a screenshot.

Vulnerabilities in Code Storage

Analysis of malware such as Vidar and Lumma shows that these programs search for files with names containing words like "Passwords," "Information," "Screenshot," "Cookie," "List," as well as files with names typical for backup codes (for example, "Backup-codes-username.txt"). These programs scan folders like "Downloads," the desktop, and other standard file storage locations, and also look for images named "Screenshot." Thus, common storage recommendations often overlap with typical malware targets.

Additionally, malware can target authenticator apps themselves, putting the second factor of protection at risk. Session cookie theft can also bypass two-factor authentication.

Consequences of Losing Backup Codes

If backup codes are lost, regaining access to your account can be difficult or even impossible. For example, Microsoft states that without alternative identity verification methods, account recovery will not be possible. Recovery attempts are limited in number and response time. Google does not set fixed recovery timeframes; the process can take from several hours to several days, and active two-factor protection increases the waiting period. Apple also warns that recovery may take several days or longer, and if the account is used on any device during this period, the process is automatically canceled.

Recommendations for Storing Backup Codes

Password managers like Bitwarden and 1Password recommend keeping emergency codes on paper in a secure location. The German Federal Office for Information Security (BSI) notes that recovery mechanisms are critically important, as using them effectively turns two-factor authentication into single-factor authentication.

BSI does not specify an exact storage location for codes, but password manager providers recommend printing the codes and keeping them outside of digital storage, such as in a safe or with important documents.

Practical Tips

1. Print your backup codes or write them down by hand and store them with your other important documents.

2. Delete any downloaded file containing the codes and empty your recycle bin to prevent malware from finding them.

3. Set up an additional recovery method for each important account—such as a backup email address, a second device, or, for Apple, a recovery contact.

4. Audit the devices where you are already logged in to your accounts to ensure their security.