A small kit.
A separate way in.
Keep the instructions simple. Protect the secrets. Make sure neither depends entirely on the missing phone.
Sources reviewed 2026-10-31. Always check the current provider instructions.
Two things to keep separately
Your plan describes which accounts matter, what each depends on and where to find the official help. Recovery Map exports this kind of checklist. It accepts no passwords or recovery codes.
Your recovery material may include provider-issued codes or a spare security key. Keep those private and outside this tool. Follow the provider's storage instructions and consider who can access the physical location.
A worked example
You keep a printed recovery checklist with your important household documents. Separately, you keep provider-issued recovery material in a protected place you can reach without opening your email. Before changing phones, you review your authenticator's transfer instructions and confirm your supported backup route. You keep the old working device until the new setup has been checked.
This is an example arrangement, not a guarantee against theft, fire or lockout. Avoid storing the only copy on the phone it is meant to recover.
The providers are not interchangeable
- Google: backup codes work once. Creating a new set invalidates the old set. Advanced Protection uses different recovery options. Check Google's code instructions.
- Microsoft: a generated recovery code replaces previous codes. Microsoft's guidance recommends a protected printed copy away from a sign-in device. Check Microsoft's code instructions.
- Apple: a recovery contact and a recovery key are different choices. Enabling a recovery key turns off the standard account recovery process. Understand that tradeoff before enabling it. Read about contacts and recovery keys.
Review after a change
Revisit the kit when replacing your phone, switching numbers, changing a password manager or regenerating recovery material. Remove obsolete copies only after verifying the replacement. A code in an old printout can look valid even after the provider has invalidated it.