How to back up your 2FA codes so you never get locked out
Two-step verification is only as good as your plan for when something breaks. Three simple layers mean a lost laptop never locks you out.
Two-step verification protects you from strangers. The flip side: if you lose your codes, it can lock you out too. The fix is simple and takes ten minutes. Set up three layers of backup and a lost laptop becomes an inconvenience, not a disaster.
Layer 1: each website's backup codes
When you turn on two-step verification, most websites offer a list of one-time backup codes (also called recovery codes). Each code works once, instead of an authenticator code.
- Save them when you set up 2FA. If you didn't, most sites let you create a new set in their security settings.
- Store them away from your computer: printed in a drawer, or in a password manager.
- In Twofold, you can add a note to each account saying where its backup codes are kept. Open the account and choose Edit.
Layer 2: encrypted sync
Sync keeps a copy of your vault in the cloud, so a new computer gets everything back. Twofold offers two kinds, and both are end-to-end encrypted with your master password before anything leaves your computer. Google stores only scrambled data that it can't read.
Chrome Sync
Open Settings → Sync & backup and turn on Chrome Sync. Your vault follows you to every Chrome where you're signed in with the same Google account. It's the zero-setup option, suited to vaults of up to roughly 250 accounts.
Google Drive
Choose Connect Google Drive. Twofold saves its data in a private app folder in your Drive. Twofold can only see that folder, not your other files. On top of syncing, it keeps a daily snapshot and holds on to the last ten, so you can go back in time if something goes wrong. Back up now makes a snapshot on demand, and Restore brings one back.
Layer 3: an encrypted backup file
A file you control is the backup that works no matter what happens to any online account.
- Open Settings → Sync & backup → Export encrypted backup.
- Choose a password for the file. It can be different from your master password.
- Save the file somewhere safe: a USB drive, an external disk or your own cloud storage.
To restore, choose Restore from file. Restoring adds accounts back and never overwrites what you already have, so it's always safe to try.
Bonus: a copy on your phone
Want your codes on your phone as well? Transfer to phone shows QR codes that phone authenticator apps can scan, a few accounts at a time. Each code then works in both places.
Don't forget the master password
Every encrypted backup is protected by a password, and nobody can recover it for you. That's the point: it's what stops anyone else from reading your vault. Write your master password down and keep it somewhere safe, separate from your computer.
A ten-minute checklist
- Save backup codes for your most important accounts.
- Set a master password in Twofold.
- Turn on Chrome Sync or connect Google Drive.
- Export an encrypted backup file to a USB drive.
- Write down your master password and store it safely.
New computer? Install Twofold, turn on the same sync and enter your master password, and your accounts and passkeys come back. If you're just getting started, see how to set up an authenticator in Chrome.