For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are meant to be used in cases where you do not have access to your second authentication factor, such as a lost device, traveling, etc.

What are some good ways/ideas to being able to carry around the backup codes on your person so that they are:

  1. Not obviously identify what service they are connected to, so that others won't see "Google Acct: 9824 24 312"
  2. Not easily able to be used by someone who steals a notecard with the backup codes on it for example.
  3. Easy for the user to understand and use without the means of anything more advanced than a basic calculator (just an example, there could be means without any device at all)
  • 1
    Backup codes are not one time pads, they're one time passwords Mar 1, 2018 at 21:06

4 Answers 4


Use the One-Time Pad method to encrypt the codes. Then you can easily decrypt them with a pen and paper as long as you remember the key. Since the 2fa code's characters are nearly-uniform (all characters are equally likely to appear in each key position), you can use a non-uniform key such as an easy-to-remember phrase.

A bonus to encrypting your codes is you can carry multiple copies of them (one in your suitcase, one in your wallet, one on a public URL) and not worry about them getting lost or stolen.

One weakness of this is if you use the same key to use a One-Time Pad to encrypt all your 2fa backup codes and one of your codes gets brute-forced, the attacker can derive the key and then decrypt all your codes. While it is standard practice for account providers to rate-limit logins to help prevent brute-force attacks, some account providers may have worse protection than others and it should not be assumed that all account providers have adequate protection. Your 2fa backup code security is then only as good as the weakest account provider. Therefore, you should use a different key for each account which negates one of the major benefits of this method: that you only have to memorize one key.

On the uniformity of 2FA codes

When using One-Time Pads (OTP) to encrypt a sentence, the key must be uniform to guard against frequency analysis. But in general, either the plaintext or the key need to be uniform. Google Authenticator and other 2fa providers use a hash generated by SHA-1 to generate the 2fa codes which is the standard for HOTP (RFC4226) and TOTP (RFC6238). While SHA-1 may not be perfectly uniform, SHA-1 is nearly-uniform and close enough to uniform that frequency analysis is not a feasible attack. Therefore, any non-obvious key such as an easy-to-remember phrase or sentence can be used to encrypt the 2fa codes.

  • 1
    As far as I can tell this is ok (although I'm not a cryptographer), but you should clarify that the passcodes are essentially being used as keys to encrypt the same plaintext. Non-random keys and reused keys are the two biggest no-nos when it comes to one time pads. Mar 2, 2018 at 14:15
  • @AndrolGenhald Yes, I've added more to my answer to justify why a non-uniform key can be used. Mar 2, 2018 at 15:57

One idea I had was to apply some sort of simple process (or cipher) to the backup codes so they are obscured, but able to decoded by remembering the process. Perhaps something like ROT13 or xor. After that, you'd print them on a business card template and set them as contact info. This boils down to security through obscurity, but at least partially helps with the problem.

  • 1
    Before I printed out my Gmail backup codes, I rotated the codes by 2 digits to help obscure them (i.e. 123456 becomes 561234).... now I have to remember that they are rotated, but I seriously doubt that anyone that steals my wallet (and the codes) would know what they are even if I hadn't made that minimal level of obfuscation
    – Johnny
    Dec 19, 2014 at 22:55

Storing them on your person is a Bad Idea.

Backup codes are bypass passwords. They are essentially a backdoor through to your 2FA-secured account. They are more powerful than the regular account password.

With this in mind, you should consider whether you want to keep them around at all. After all, if backup codes exist, they become more valuable than your account's password. Your account would be more secure if none of those backup passwords exist: they are the antithesis of why 2FA exists in the first place. You should treat them as first-class passwords. Do you carry your regular passwords in written form in your wallet?

There is a very high chance these codes are for your GMail account, or your iCloud account, or your Amazon account... There is no need to specify what service they are for, the most common and obvious are going to be tested and most probably the thief will be right. With this being said, I don't think there is a best practice for this.

I (only partially) disagree with the answer advising to use a one-time pad for backup codes. Doing this requires you to generate and remember as many keys as you have passwords, which amounts to as much as remembering the passwords themselves. Whether the keys can be easy-to-remember passphrases or not, you can only remember so many (and usually you get backup codes in batches of ten, and you can't write down the keys). If you insist on writing backup codes down, then consider this solution.

But my advice is, if you really must keep backup codes on "yourself", consider learning one (or two) per service and disabling the rest. Please don't write them down.

  • 1
    In regards to the "one time pad" suggestion I misinterpreted this at first as well, but it actually only requires a single secret to be remembered. Not sure if it should really be called a one time pad though, as the backup codes are not truly random. Mar 2, 2018 at 17:44
  • 1
    No, one-time pads really do require a different key for each plaintext. How you define "one" plaintext is another question, but I assume that if you used a single key for all your backup codes, then breaking one would amount to breaking all of them at once.
    – korrigan
    Mar 2, 2018 at 17:50
  • 1
    In this scenario the "key" is the backup code and the "plaintext" is the memorized secret. And yes, knowing one backup code and its encryption would reveal the secret. Mar 2, 2018 at 17:53
  • 1
    That's not right, because the ciphertexts are that of the backup codes, not the memorised passphrase. So you have N ciphertexts each encrypted using the same key -- not a one-time pad. It's amounts to simply a symmetric encryption with an easy to compute algorithm you can compute yourself.
    – korrigan
    Mar 2, 2018 at 18:11
  • 1
    I'll admit I'm not 100% sure about this, and as I've said before I'm not a cryptographer. That being said, yes the ciphertext is intended to represent the plaintext (memorized secret), but if you already know the plaintext you can also use it to recover the one time pad (backup code). Mar 2, 2018 at 18:21

I'd suggest storing them in a breakable opaque plastic container like Is used for the American presidents nuclear launch codes.

That way they can only be used by breaking the container making it difficult for the codes to be duplicated or used without your knowledge.

If only I could work out where to source them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .