Two-factor authentication (2FA) stops most account takeovers. But if your codes live only in an authenticator app on one phone, losing that phone can lock you out as thoroughly as it locks attackers out.
The two things to keep safe
- Backup codes. Most services show 8-10 one-time codes when you turn on 2FA. Each works once, instead of a code from your app.
- The setup key (TOTP secret). The QR code you scan contains a secret, usually also shown as text such as "JBSW Y3DP EHPK 3PXP". Whoever has it can generate the same six-digit codes as your phone.
Where to keep them
- In an end-to-end encrypted vault, next to the login they belong to. Potent Cipher's login items hold the site, username, password and the 2FA secret, and show the current six-digit code right there. The secret is encrypted on your device with everything else.
- On paper, for your most important account (usually email). Paper can't be hacked, only found, so keep it somewhere private.
Avoid screenshots in your photo library, unencrypted notes, or the same email account the codes protect.
Lost or broken phone: what to do
- Sign in with a backup code (or a code from your vault) on each important service.
- Turn 2FA off and on again to link your new phone, and save the new backup codes.
- Revoke the old phone's sessions in each account's security settings.
- If you had no backup, use the service's account recovery. It is slow on purpose; start with your email account.
Prefer app codes or passkeys over SMS
SMS codes can be stolen by SIM-swapping. Authenticator codes (TOTP), security keys and passkeys are all stronger. Whichever you use, the rule is the same: set up recovery the day you turn 2FA on, not the day you need it.