Recovery Options That Work When You Need Them

Time: twenty minutes once, then twenty minutes a year. Repeat: the same day you change your phone number.

Set recovery up while you still have access

Configure this today, on an ordinary afternoon, from a device that is already signed in. Everything on this page is impossible to arrange at the moment you need it, which is the only moment most people think about it.

A provider will not give an account back because you are certain it is yours. There is no human on the other end weighing your sincerity. There is an automated check against things you registered in advance, and if none of them answer, the answer is no. Your certainty is not one of the inputs.

Expect each of the four routes to fail, in its own way

Set up at least two of the four, and pick two that do not fail together.

Backup codes get lost. They are a piece of paper or a file, and paper goes into a drawer that gets emptied during a move.

A second email address dies with its own provider, or gets deleted for inactivity, or turns out to be an address you abandoned four years ago.

A phone number changes. You switch carrier, you move country, the number is recycled and given to somebody else, and the codes go to them.

A trusted device gets sold. It stays trusted for as long as the account thinks it exists, which is often longer than you owned it.

The failures cluster. Backup codes stored in the mailbox they recover and a second factor on the same phone as your only mail are two ways of losing everything with one event, which is the same trap described in the settings that decide who else can read your mail.

Print the backup codes and keep them off the machine

Print them, cut the sheet in two halves that are each complete, and put the two copies in two different physical places.

Two places, because one place is a fire, a burglary or a move. Physical, because the point of these codes is to work when you cannot get into anything digital. And not in the mailbox they unlock, which sounds obvious written down and is where a remarkable number of people keep them, filed under a subject line that somebody with access can find in four seconds.

A photo of the codes in your phone gallery counts as the mailbox, if the gallery syncs to the same account. If you want them in the password manager as well, that is fine as a second copy, provided the manager is not itself protected only by the mailbox you are trying to recover.

Codes are single use. When you spend one, cross it out; when you are down to the last two, generate a fresh set and destroy the old sheet.

Put the backup address at a different provider

Choose a recovery address hosted somewhere other than the account it recovers, and give that address its own second factor.

Two mailboxes at the same provider share a fate. One suspension, one automated policy decision, one outage on a bad day, and both are unreachable at once. A recovery address is a second door, and a second door in the same wall is a window.

Watch for the loop. If mailbox A recovers B and B recovers A, then losing either one takes both, and you have built a circle with no way in. The way out of a circle is something that is not a mailbox: printed codes, a hardware key, or an address at a third provider that exists only for this.

Keep that address alive. An account nobody signs into gets deleted on a published schedule, and a mailbox left to go quiet is worth nothing as a recovery route on the day it counts.

Update the phone number on the day it changes

When you change your number, go through the accounts that hold the old one before you cancel the old line.

Do it in that order and it takes twenty minutes. Do it afterwards and some of those accounts will ask you to confirm the change with a code sent to a number that is no longer yours. That is the trap: the old number is both the thing you are replacing and the key that authorises replacing it.

The same applies to an address you are retiring, and there the window is longer and the list is bigger, which is why moving to a new address is a project rather than an afternoon.

Know what recovery looks like when nothing was set up

Look at the alternative honestly, because it is what you are buying insurance against.

You fill in a form. It asks when you created the account, which devices you have used, who you write to often, what folders you made, and what the subject lines of recent messages were. You answer as well as you can from memory, and memory is worse than you think. Then you wait, sometimes days.

The reply is usually a single line saying the information provided was not sufficient. It does not say which part failed, because saying so would tell an attacker what to fix. There is often no appeal and no second attempt worth making, and there is nobody to argue with. People lose accounts of fifteen years this way, over a phone number they changed and never updated.

Audit the recovery settings on the accounts that matter

Open your five most important accounts today and read what each one would use to let you back in.

Five, not fifty. The mailbox itself, whatever holds money, the password manager, the phone or computer account that holds your photos, and the one work login you cannot do your job without. Anything else can wait a year.

For each, write down the routes it offers and which of them are currently pointing somewhere real. Keep that note outside the mailbox, on paper or in the password manager, along with a line about who should be able to find it if you cannot, because somebody eventually has to.

If the audit turns up a route pointing at an address you no longer control, treat it the way you would treat a break-in and check what else that address still touches, using the order that stops the damage spreading.

Keep the throwaway mailbox out of this entirely

Never nominate a temporary address as a recovery route, including the one on this site's front page.

That inbox exists to absorb one-off confirmations and then disappear. It has no password, a guest mailbox opens by name alone, and the address goes back into circulation after it expires. Every property that makes it useful for a single signup makes it worthless as the thing standing between you and a permanent lockout.

The checklist

• Set up at least two recovery routes that cannot fail from the same event.
• Print the backup codes, split them between two physical places, and keep them out of the mailbox they unlock.
• Point the backup address at a different provider, give it its own second factor, and sign into it at least once a year.
• Update every stored phone number before you cancel the old line.
• Once a year, open your five most important accounts and confirm each recovery route still points somewhere you control.