How to back up your 2FA codes (and test the backup)

An authenticator with no backup is one lost phone, one wiped browser or one bad update away from locking you out of your accounts. Here's how to make sure that can't happen, and how to check it.

Why codes get lost

Two-factor codes are made from a secret that's stored only in your authenticator. If that copy is gone, the site can't send it again. You go through each site's account recovery instead, which can take days or fail. Copies disappear when:

a browser extension is removed, or Chrome's data is cleared,
a computer is replaced or wiped,
a phone is lost, broken or reset,
an app update or sync problem goes wrong.

Three layers that protect you

Your sites' own recovery codes. Most sites give you a set of one-time backup codes when you turn on 2FA (Google's backup codes page describes Google's). Save them somewhere safe. They work even if every authenticator is gone.
A backup of your authenticator. A copy of all your accounts that lives outside the app, so removing the app doesn't remove it.
A second device. Keeping the same accounts on your phone and in Chrome means losing one still leaves the other.

How Never Lose Codes backs up

Automatically, after every change. About 8 seconds after you add, edit or delete an account, an encrypted backup file is written to Downloads/NeverLoseCodes (inside whatever folder Chrome saves downloads to). One is also written every day.
Encrypted. The file holds no readable codes or account names. It opens only with your recovery key.
Outside Chrome's storage. Because it's an ordinary file in your Downloads folder, it survives removing the extension, clearing Chrome's data, or reinstalling Chrome.
Several versions kept. The newest 3 are always kept, plus one per hour for the last day, one per day for 14 days, and one per week for 8 weeks. A file is only cleaned up once a newer backup has been checked.
Checked. After each file is written, the extension confirms with Chrome that the whole file was saved. A weekly integrity test also confirms every account still decrypts.

Check your backup today

Open Never Lose Codes' full view and go to Shield.
Look for four green checks: encrypted on this computer, encrypted backup file, recovery key saved, and the weekly integrity test.
Click Back up now, then Run integrity test. Both should report success.
Open your Downloads folder and find the NeverLoseCodes folder with your backup files.

Go one step further: copy a backup off the computer

A backup on the same computer won't help if that computer is lost or its drive fails. Every so often, copy the newest file from Downloads/NeverLoseCodes to a USB stick, an external drive, or a cloud folder you trust. The file is encrypted, so a copy in the cloud doesn't expose your codes on its own. Keep your recovery key somewhere separate from the file.

Do a real restore test (5 minutes)

The only way to know a backup works is to restore it. A safe way to do that:

On a second computer, or in a separate Chrome profile on this one, install Never Lose Codes.
On the setup screen, choose I have a backup file.
Pick your newest backup file and type your recovery key.
Check that all your accounts appear and their codes match.
Remove that test copy afterward if you don't need it.

Restoring never deletes or overwrites anything. It only adds accounts you don't already have, so restoring into a copy that already has codes is safe too.

Common backup mistakes

Keeping the key next to the file. A backup file and its recovery key in the same folder or email is everything someone needs.
Never restoring. A backup that's never been opened is a hope, not a plan.
Only one copy, on one computer. Drive failures and stolen laptops take the backup with them.
Skipping sites' recovery codes because you have an authenticator backup. They protect against different failures.

What a backup can't fix

If you lose both your recovery key and every working copy of the app, the backup files can't be opened. That's by design: nobody, including us, can open them without the key. Save the key, and save each site's recovery codes too.

Never Lose Codes is a Chrome extension that keeps your 2FA codes encrypted on your computer, with backup files you hold and a recovery key. See how it works.