Make a Safe Backup of Your Two-Factor Recovery Codes
Every account that offers two-factor authentication hands you recovery codes — and most of them end up in random screenshots and downloads folders, unfindable at the exact moment your phone is lost. This tool organizes codes you already own into one clean, labeled sheet: printable for a safe or drawer, or exportable as an encrypted vault file. Everything happens locally; your codes are never stored or transmitted by us.
The actual tool runs in our ad-free secure workspace — nothing on this page processes your file.
Open Recovery-Code Sheet →What this tool does
- Collects recovery codes you paste in and organizes them by service, with labels and notes.
- Produces a cleanly formatted printable sheet designed for offline storage.
- Alternatively exports the whole set as an encrypted .svault file (AES-256-GCM, password-protected).
- Lets you mark codes as used, so the sheet stays accurate across incidents.
- Keeps nothing: the tool holds your codes only in page memory while you work.
- Warns explicitly against putting cryptocurrency seed phrases into it — those need a different threat model entirely.
Your privacy on this tool
Stays on your device
- Codes exist only in your browser's memory while you assemble the sheet.
- Printing goes directly from your browser to your printer; encrypted export is generated on-device.
- We never store, transmit, or see any code — closing the tab leaves nothing behind.
Reaches our server: nothing
This tool makes no upload. Your content is processed entirely in your browser.
How to use it
- Gather your recovery codes from wherever they landed — screenshots, downloads, emails to yourself.
- Open the tool at /app/recovery-code-sheet.
- Paste each service's codes and label them (email, bank, password manager, work SSO).
- Choose your output: print a physical sheet, export an encrypted .svault file, or both.
- Store the print somewhere genuinely secure — a home safe or locked drawer — and delete the scattered screenshot copies.
- When you use a code, mark it used and reprint; a stale sheet fails exactly when needed.
Common uses
- Consolidating years of accumulated recovery codes into one findable, labeled place.
- Preparing for a phone upgrade or repair, when authenticator apps are most likely to strand you.
- Making an emergency-access sheet a spouse or executor could use if something happens to you.
- Backing up the recovery codes for your password manager itself — the account you cannot afford to lose.
- Creating an encrypted digital copy to keep alongside encrypted backups on an external drive.
Supported formats
- Pasted text codes as input
- Output: printable sheet (via your browser's print dialog) or encrypted .svault file
Works in all modern browsers; printing uses the browser's standard print dialog, so anything that can print a web page can produce the sheet.
Limitations & security notes
Limitations
- The tool organizes codes you already have; it cannot generate or recover codes for any service — only each service can issue its own.
- A printed sheet is exactly as secure as where you put it; it trades digital risk for physical risk deliberately.
- The encrypted export needs its password to open, with all the usual finality: lose the password (and any recovery key), lose the backup.
- This is not the place for cryptocurrency seed phrases — a browser tab is the wrong trust level for keys controlling irreversible funds, and the tool will tell you so.
- SecretPNG is in beta and has not been independently audited.
Security notes
- Recovery codes are skeleton keys — each one bypasses your second factor entirely. Treat the sheet with the same seriousness as the accounts it unlocks.
- Paper in a safe is a legitimately strong medium: immune to malware, ransomware, and cloud breaches. Its enemies are fire, water, and loss — consider two copies in two places for critical codes.
- If you keep the encrypted export, store its password in your head or your password manager — not written next to the file.
- Screenshots of recovery codes in your camera roll sync to cloud photo services; after consolidating, go delete them.
- Never store recovery codes in the same place as your password manager's own data if the codes are what rescue you from losing that manager.
Frequently asked questions
- Why do recovery codes matter this much?
- Because they are the answer to 'my phone is gone and my authenticator app went with it'. Without them, account recovery means support tickets, identity verification, waiting periods — and for some services, permanent lockout. With them, you are back in immediately. They are the seatbelt of two-factor authentication: pointless until the one day they are everything.
- Is printing codes on paper actually a good idea?
- For most people, yes — a locked drawer or safe at home defends against the attacks that realistically threaten you (remote hacking, phishing, cloud breaches) far better than another digital copy does. The paper's threats are physical and local, which for household threat models is usually the easier problem. High-risk situations (shared housing, domestic surveillance) shift the calculus toward the encrypted file instead.
- Why the warning about cryptocurrency seed phrases?
- Seed phrases are not recovery codes — they are the asset. Anyone who reads a seed phrase controls the funds, irreversibly, with no service to appeal to. That threat model demands hardware wallets and offline practices beyond what any browser-based tool should be trusted with, ours included. The warning exists because the two things look similar and are absolutely not.
- What happens to my codes when I close the tab?
- They are gone from our side of the equation — which was nothing to begin with, since the codes never left your browser's memory. Whatever you printed or exported is now the only product of the session. There is no draft, no history, no account holding a copy.
- Should I pick the printed sheet or the encrypted file?
- Ideally both, stored differently: paper in a safe covers the digital-disaster scenarios, and an encrypted .svault on a backup drive covers fire, flood, and 'the safe is 500 miles away'. If choosing one, most people are better served by paper — it cannot be phished, and its failure modes are ones humans intuitively understand.
Related tools
Was this tool helpful?
Last reviewed: 2026-07-14Open Recovery-Code Sheet
SecretPNG is in beta and has not been independently audited. Security status.