Why this is a separate task from changing your recovery number
Retiring a phone or SIM removes a device and a phone number you may have relied on for sign-in. Before that happens, you want a second-step method that does not depend on that hardware or that number. Backup codes are one such method: a set you keep offline and use one at a time.
This is not the same as updating the recovery contact details attached to your account. If the next thing on your list is replacing the phone number that Google uses to reach you, see the related guide on updating Google recovery details before retiring an old phone number. Doing both, in either order, leaves you with a second-step fallback and current contact details.
What backup codes are, and what they are not
Google backup codes require 2-Step Verification, work once each, and can be downloaded or printed from the Backup codes section of Security and sign-in settings. Source
Three practical consequences follow from that:
- They are a second step, not a first one. Backup codes do not replace your password. Keep your password and your primary second step working.
- They are single-use. Each code is spent when used, so you need to track which ones remain.
- They live where you choose to keep them. Downloading or printing is the point; the value is in having them somewhere that is not the phone you are retiring.
Backup codes are not a way to regain an account you are already locked out of, and nothing here should be read as a promise of recovery. If you cannot sign in now, this checklist does not apply to that situation.
Before you start: confirm you can still sign in
Do this while you still have working access, ideally before you wipe, sell, trade in or hand over the old phone, and before the SIM is deactivated.
- Sign in on a device you will keep.
- Confirm that 2-Step Verification is on. Backup codes are tied to it, so if it is off, codes are not the tool you need.
- Decide where the offline copy will live: a printed sheet in a locked drawer, a password manager’s secure note, or another place that is not the phone being retired and not the SIM-dependent number.
- Decide who, if anyone, can reach that copy in an emergency. Write that down before you store anything.
Do not turn off 2-Step Verification to simplify the transition. Removing your second step while you are changing hardware narrows your options rather than widening them.
Create the set
- Open Security and sign-in settings for your Google Account.
- Go to the Backup codes section.
- Download or print the codes. If both options are offered, choose the one you can actually store safely; a download that sits in the old phone’s storage is not an offline copy.
- Check that the copy is complete and readable before you close the page. A partial printout or a screenshot with codes cut off is not a usable set.
Store it so it survives the phone and the SIM
The test is simple: if the old phone is wiped and the old number stops working, can you still reach the codes?
| Storage choice | Works if the phone is gone? | Works if the SIM/number is gone? | Notes |
|---|---|---|---|
| Printed sheet in a locked place | Yes | Yes | Check readability; store away from the device |
| Password manager secure note | Yes, if you can sign in to it without the retired phone | Depends on the manager’s own second step | Make sure the manager itself is not locked to the old number |
| Note or file on the old phone | No | No | Not an offline copy for this purpose |
| Message to yourself on a number you are retiring | No | No | Lost with the number |
| Photo in a cloud account that requires the old phone to open | Unreliable | Unreliable | Test access before relying on it |
Two rules keep this honest:
- Keep the copy out of sight of anyone who should not have it. Do not post codes, email them to a shared address, or leave them in a plain text file on a shared computer.
- Keep a record of what you created and when, without writing the codes themselves into that record.
Record the set without exposing it
A short inventory note is enough. It helps you later decide whether a set is current.
- Date the set was created.
- Where the offline copy is stored (for example, “locked drawer, home office” or “password manager, vault name”).
- How many codes the set contains, if the page tells you.
- Which codes have been used, tracked by position or by a masked reference, not by copying the code into the note.
- Date any set was replaced and why.
If you would rather not keep a count, record only the creation date and storage location. The point is to know, months later, whether the sheet in the drawer is the current one.
Use a code when you need one
- At the second-step prompt, choose the backup-code option.
- Enter one unused code exactly as printed.
- Mark that code as used in your inventory note.
- If the code is rejected, check for transcription errors such as look-alike characters before trying another. Do not burn several codes in a row on the same typo.
- If you are running low, generate a new set rather than waiting until the last code is gone.
Replace the set
Generating a new set invalidates the previous set; accounts in the Advanced Protection Program cannot download backup codes. Source
That makes replacement a deliberate step, not a casual refresh:
- Confirm you still have working access and a second step you trust.
- Generate the new set and store it before discarding the old copy.
- Destroy the old copy once the new one is confirmed readable and stored.
- Update your inventory note: new creation date, new storage location, and a line saying the previous set was invalidated on that date.
Do not generate a new set “just to check” if the current one is the only offline fallback you have and you cannot store the replacement immediately.
The Advanced Protection exception
Accounts enrolled in the Advanced Protection Program cannot download backup codes. If that applies to you, this checklist stops at the exception branch: there is no backup-code set to create, store or replace. Plan your second-step fallback around what that program does provide, and treat the phone retirement as a separate scheduling question. Do not assume a workaround exists, and do not disable protections to make codes available.
If you are unsure whether the program applies to your account, check your account’s security settings while you still have access, rather than after the old phone is gone.
Failure paths and what to do
| Situation | What to do |
|---|---|
| You cannot sign in at all | This checklist does not apply. Do not expect backup codes to unlock an account you are already locked out of. |
| The printed copy is unreadable or incomplete | Regenerate only if you can store the new set immediately; otherwise fix the copy first. |
| The codes were stored only on the old phone | Treat the set as lost. Regenerate from a device you are keeping, if you still have access. |
| The old number was the only way into your password manager | Fix the manager’s access before relying on it for codes. |
| You are in Advanced Protection | No backup codes; use the program’s own methods. |
| A code was used but not marked | Update the note as soon as you notice; a used code will not work again. |
A short pre-retirement sequence
- Confirm access and that 2-Step Verification is on.
- Create the backup-code set and check the copy is complete.
- Store it offline, away from the retiring phone and SIM.
- Write the inventory note: date, location, count, used codes.
- Handle the recovery contact details as a separate task if the number is changing.
- Only then wipe, sell or hand over the phone, and only then let the SIM go.
Where a username lookup fits, and where it does not
If part of your reason for retiring the phone is tidying up old accounts, a username lookup can show public profiles that use a handle you recognize. TraceSeek covers 3,000+ platforms, and the first scan is free without registration or login; the product states a scan takes 20-30 seconds. That is a lead-generation step for a cleanup list, not proof that a profile belongs to you or to anyone else. A lookup does not change account settings, does not produce backup codes, and does not verify anyone’s real identity. Keep the backup-code work in your account settings, where it belongs.
What this checklist does not cover
- It does not recover an account that is already inaccessible.
- It does not confirm that a code set is valid beyond the account page that issued it.
- It does not cover platform menus or rules beyond the reviewed claims above.
- It does not replace your password or your primary second step.