Two-step sign-in and backup codes: the lock your family cannot pick

The password is only half the door

When you sign in to an account, the company often asks for something more than your password. A code sent to your phone. A prompt on an app. A short number from a list you printed once. That second step is there to stop a stranger who has guessed your password, and it works. It also stops your family, because the second step is usually tied to your phone or your device.

So a password list on its own is not enough. Your family needs to know where the second step goes and how to get past it. That is the part people forget to write down.

Find out which accounts ask for a second step

Start with the accounts that hold money, records or years of your life. Email first, because most other accounts send their reset links there. Then banking, utilities, insurance, your phone account, and anything with photos or documents you would hate to lose.

Sign in to each one and look in its security settings. Most companies show you a list of the second steps you have turned on. Write down what you find, even if the answer is that you only have a password.

Backup codes: what they are and where to put them

Many accounts let you generate a set of backup codes. Each code works once, and any of them will get you past the second step when your phone is not available. They are the simplest thing you can leave behind, because they do not depend on a phone, a signal or an app.

Generate them, print them or copy them by hand, and keep them somewhere your family can reach. Do not leave them only on the device that holds the account. If the account is on your phone and the codes are on your phone too, nobody can use them.

1. Sign in and open the security settings for the account.
2. Find the backup codes option and generate a fresh set.
3. Write the codes on paper or print them, and label which account they belong to.
4. Store that paper with your other login notes, not in the same place as your phone.
5. Go back and generate a new set if you ever use one or think someone has seen them.

Some accounts also let you add a second phone number or a second email for recovery. Adding a number your family can reach is another way in that does not depend on your own phone.

The phone number problem

A lot of second steps go to your mobile number. If your phone is locked, lost or turned off, that code goes nowhere. Your family may need to keep your number active long enough to receive codes, and that means talking to your phone company. Rules and paperwork differ, so check the company's current help page for what they ask for.

It helps to write down which company provides your mobile service, your account number if you know it, and whether the number is in your name alone. That saves your family a search at a bad moment.

Write it so someone else can follow it

For each important account, note the email or username, the password, and the second step it uses. Say where the backup codes are kept. If the second step is an app on your phone, say so, and say which phone.

Keep the notes plain. A line like "email: second step is a code to my mobile, backup codes in the blue folder" tells your family more than a page of detail. If you are moving passwords into a password manager, our guide on importing your passwords covers how to do that without losing the notes your family will need.

One more thing worth writing: your wishes about the accounts themselves. Which ones should be closed, which should stay open for a while, and who should have the photos. That belongs in the same place as the logins, so it is found together.

Keep it current

Backup codes go stale. You use one, you change your phone, you turn a second step off and on again. Once a year, open your notes, check that the codes still exist, and replace any that are used or missing. A short review is easier than starting over.

If you set up a legacy contact or a similar feature on an account, note that too, and check that the person you named is still the right one. Our guide on legacy contacts explains how those settings usually work.

Where this goes in your envelope

This belongs in the Logins and passwords section. Put the account list, the second step notes and the location of the backup codes together, so the person opening the envelope sees one clear picture rather than pieces in different places.

If you want a hand getting started, you can create an account and work through it a section at a time. The point is not a perfect list. It is that someone you trust can pick it up and use it.