Many websites give you a recovery key or a list of recovery codes that can be used in place of 2FA tokens if you lose your phone or can't access your token generator.
What are the recommended practices when it comes to storing these codes?
Should these recovery codes be stored along with the password in a password manager? Should they be physically written down and stored somewhere safe?
My main concern is the password manager being a single point of failure. If my password manager is compromised, 2FA is essentially worthless on all the accounts that have it enabled.