Recovery Codes: The Paper Backup
The most common account disaster for aging parents is not a hacker; it is a lost phone and a forgotten password at the same time, with no way to prove who they are. Recovery codes are the printed backup that fixes exactly that. This page covers what they are, how to set them up on the major platforms, and where to store them so they survive the emergency.
set them up now, print them, store them where the family can find
The recovery codes map
Two-factor makes accounts dramatically safer, but it creates a new single point of failure: the phone. Recovery codes work without the phone, which makes them the difference between a locked account and a recovered one.
- Why they existThe phone is the single point of failureWhen the parent's phone is lost, broken, or replaced, the codes that go to that phone stop arriving. Recovery codes are the one-time-use backup codes issued when two-factor is set up, and they work without the phone: the locked-out moment is exactly when codes are impossible to create.
- The setupPlatform by platformGoogle: security settings → two-step verification → backup codes, plus recovery phone numbers and a recovery email. Apple: Apple ID security → Recovery Key and recovery contacts (trusted family members). Other platforms follow the same pattern: security settings, two-factor or account recovery, backup codes.
- Where they livePrint themA screenshot on the phone dies with the phone; paper survives. Store the printout with the family's key documents, the same folder that holds the will and the passwords list, not in the phone case.
- The honest ruleRecovery paths are set before they are neededRecovery contacts and recovery keys are the additional paths Google and Apple offer, and the vault recovery drill applies the same tested-path logic to the family's own systems.
The rule, in one sentence: set up recovery codes now, print them, and store them somewhere the family can find, because the locked-out moment is exactly when codes are impossible to create.
Why recovery codes exist
Two-factor authentication makes accounts dramatically safer, but it creates a new single point of failure: the phone. When the parent's phone is lost, broken, or replaced, the codes that go to that phone stop arriving. Recovery codes are the one-time-use backup codes issued when two-factor is set up. They work without the phone, which makes them the difference between a locked account and a recovered one. The same logic applies to recovery contacts and recovery keys, which Google and Apple offer as additional paths back in.
The setup, platform by platform
- Google: in the Google Account security settings, find the two-step verification section, then the backup codes option. Google issues a set of one-time codes, and the account can also name recovery phone numbers and a recovery email.
- Apple: the Apple ID security settings offer a Recovery Key, plus recovery contacts (trusted family members) who can help unlock the account. Apple's guidance explains both paths.
- Other platforms: the pattern is the same: security settings, two-factor or account recovery section, backup codes. If a platform offers codes and the parent uses that platform for anything important, set them up.
Where the codes live
- Print them. A screenshot on the phone dies with the phone. Paper survives.
- Store them with the family's key documents, not in the phone case. The same folder that holds the will and the passwords list works.
- Tell one trusted person where they are. A code the family cannot find is the same as no code.
- Keep the full list safe: each code works once, so the parent should not test one, use one, and lose the rest.
- Regenerate after use. When codes run low or a code is used, the platforms let the family issue a fresh set.
The one-time setup session
Set this up as a scheduled task, not an emergency task: one evening, the parent's accounts open, the family walks through each platform's recovery section, prints the codes, and files them. The National Institute on Aging's guidance on passwords and accounts makes the broader point this fits into: the goal is fewer secrets and more backup paths, set up while the parent can still participate in the decisions.
Related
- Two-factor authentication: the second step that makes codes necessary.
- Account recovery when locked out: the order that works.
- The family password vault: where the rest of the access lives.
- Digital legacy setup: what happens to accounts later.
Sources
- Google Account Help: Use backup codes to sign in (retrieved August 2026)
- Apple Support: Recovery Key for Apple ID (retrieved August 2026)
Found an error? Report it.