LIFE · BMC FIELD MANUAL
Digital Account Recovery Plan: Password Manager, MFA, Passkeys and Backup Codes
The strongest login is not finished until you know how recovery works. Build a plan that survives a lost phone, a broken laptop and a panicked Tuesday without creating an easier path for an attacker.
The useful answer
- Secure the primary email and password manager first because many other recovery paths depend on them.
- Use unique passwords and stronger MFA, including passkeys or security keys where practical, while documenting provider-specific recovery methods.
- Store backup codes and recovery keys outside the device they are meant to rescue, with access controlled and tested.
- Remove stale phone numbers, devices, app passwords and trusted sessions that can quietly become alternate entry points.
- Run a non-destructive recovery drill and keep a one-page map of accounts and actions—not a plaintext list of secrets.
Map the accounts whose failure spreads
Start with accounts that can reset, approve or pay for others: primary email, password manager, mobile carrier, device-platform account, financial accounts, domain registrar, workplace identity and cloud storage. Add government, health, insurance and social accounts according to consequence. This is a dependency map, not a list of every newsletter login.
For each account, record the official service URL, username or identifying email, enrolled authentication methods, recovery channel, trusted devices, recovery contact, backup-code location and last review date. Do not put passwords, one-time codes, recovery keys or answers to security questions in an unencrypted planning document. The map should tell a trusted person where the secure record is and what procedure to follow, not reveal the secret itself.
Draw arrows where one account can recover another. If email resets the password manager, the password manager opens email, and the same phone receives both recovery codes, the circle needs an independent break-glass route. Concentration is not automatically wrong, but hidden circular dependence is.
Harden the primary email and password manager
Use a unique password for every account and let a reputable password manager generate and store them. CISA's consumer guidance recommends strong passwords and a password manager, while current NIST federal identity guidance emphasizes long passwords, blocklists and support for password managers rather than arbitrary composition rituals. A consumer should follow each provider's rules without copying a government control out of context.
Protect the password manager with a strong, unique master password that is not stored in the same vault as the only copy of itself. Enable the provider's strongest practical multifactor option and save its emergency or recovery material according to the provider's instructions. Understand whether the company can recover the vault, whether loss of the recovery key is permanent, and how a new device is authorized.
Treat primary email as an administrative root. Review forwarding rules, delegates, app passwords, connected apps, recovery addresses, recovery phone numbers and active sessions. Remove entries you no longer control. Turn on security notifications and know where they arrive. An old forwarding rule can outlive a password change and quietly copy future reset messages.
Choose MFA that improves both security and recoverability
MFA combines separate factors so a stolen password alone is not enough. CISA urges users to enable it and to prefer phishing-resistant methods where available. Passkeys and hardware security keys can resist common fake-login attacks better than codes that a person can be tricked into typing into an impostor site. Availability and recovery design vary by provider.
Record every enrolled factor: authenticator app, passkey, security key, built-in device credential, phone call or text. Do not call all of them equivalent. Text messages can be useful where better methods are unavailable, but phone-number changes, SIM fraud, travel and lack of signal create recovery risks. A passkey synchronized across a platform may recover differently from a device-bound key.
Enroll more than one approved factor when the service allows it. That might mean two hardware keys stored separately, a passkey plus a recovery key, or an authenticator plus sealed backup codes. Do not weaken the account with an easy knowledge question merely to avoid lockout. Recovery is part of authentication and should be protected accordingly.
Store backup codes outside the failure
Generate backup codes only from the official account settings and label them with the service, account identifier, generation date and whether using one invalidates it. Store them somewhere protected from casual access, fire, theft and the same device failure they are intended to solve. A screenshot on the only phone is not an independent recovery route.
Possible locations include an encrypted vault with an independent unlock path, a sealed copy in a secure home document file or another controlled location. The right choice depends on threat model and household. Avoid sending secrets to yourself by ordinary email or placing them in a shared notes app without understanding encryption, sharing and account recovery.
When codes are used, regenerated or exposed, update the record promptly. If a provider issues one recovery key that cannot be retrieved again, verify the stored copy character by character without attempting a destructive reset. Make sure the people who may need emergency access understand that photographing, copying or testing a secret can itself create risk.
Plan for a lost phone and a dead computer
Write the first hour for device loss. From a known clean device, use the official device-finding service, lock or erase as appropriate, contact the carrier through a verified route, revoke sessions, review account alerts and change credentials in risk order. Do not use a link sent by an unknown person claiming to have found the device. Lost-device scams often aim directly at the owner's platform password.
Know which authenticators transfer automatically, which require an encrypted backup, which need an old device and which do not transfer at all. Confirm this in the current official documentation. Before replacing or wiping a phone, move each authenticator and verify the new factor while the old route still works. A successful transfer is not proven by seeing account names in an app; confirm that a real provider accepts the new setup.
Keep operating-system recovery material, disk-encryption recovery keys and device-platform recovery separate enough to survive one failure. If a work device or managed account is involved, follow the employer's incident route rather than improvising. Remote wiping can destroy evidence or the only copy of a token, so sequence actions based on risk and official guidance.
Design trusted access without casual sharing
Decide what should happen during incapacity or death. Password sharing by text or a paper list in an obvious drawer creates ongoing exposure. Many password managers and platforms offer emergency-access, legacy-contact or inactive-account features with delays and scopes. Use the provider's official feature, document what it does, and review whether it grants data access, account control or only a copy of selected information.
Coordinate the technical plan with a will, power of attorney, business-continuity plan and professional advice where needed. A trusted contact should know that a plan exists, where instructions are held and whom to call; that does not mean giving immediate access to every personal account. Business, client, medical and financial information may carry legal or contractual duties.
Use the minimum disclosure that meets the purpose. A household contact may need the carrier account route and the location of sealed instructions but not daily access to private messages. Revoke or revise access when relationships, roles or providers change.
Run a recovery drill without locking yourself out
Quarterly or after a major change, review the map from a second trusted device. Confirm official URLs, current phone numbers and email addresses, backup-code locations, enrolled keys, trusted devices and emergency contacts. Check that you can sign in with a secondary approved factor. Do not click 'forgot password,' remove the primary factor or consume a one-time code merely to make the drill feel realistic.
Review recent sessions and security events while signed in through a known route. Remove old phones, browsers and integrations. Confirm that alerts reach a channel you still control. Update recovery records after moving, changing numbers, replacing devices, switching password managers or adding a family or business administrator.
If compromise is suspected, use a clean device and the provider's official security page. Preserve important notices, revoke sessions, change the primary email and password-manager credentials in the right order, replace exposed factors and review financial or identity-theft actions as appropriate. Do not negotiate through the attacker's message or pay someone who promises guaranteed recovery.
Keep the one-page recovery map
The finished sheet should list the critical account, official URL, dependency, enrolled factors, backup route, secure-secret location, trusted contact, last test and next review. Add a priority number so a stressed person knows that email, password manager, carrier and device platform usually come before social or shopping accounts. Keep the sheet itself free of live secrets.
Print or export only when you can control the copy. Date it, store it with the home emergency documents and destroy superseded copies securely. If the digital copy lives in the password manager, keep an independent instruction that explains how the vault is recovered. If the paper copy points to a safe, make sure the right person can legally and practically access it.
Account recovery is not a one-time setup. Providers add passkeys, retire legacy methods and change device-transfer behavior. A short recurring review is more reliable than a perfect plan that has not been opened since the last phone number.
Frequently asked questions
Should I keep all backup codes in my password manager?
A protected vault can be one location, but do not let the only recovery copy depend on the same device or account failure. Follow the provider's model and keep an independent controlled route.
Are passkeys the same as passwords?
No. Passkeys use public-key cryptography and can be phishing-resistant, but their storage, synchronization and recovery depend on the provider and platform.
Is text-message MFA useless?
No, it can be better than password-only access where stronger options are unavailable. It has phone-number and phishing risks, so prefer stronger supported methods for high-value accounts.
What belongs in the recovery plan?
Account identifiers, dependencies, enrolled methods, official routes, secure-secret locations, contacts and review dates—not plaintext passwords or live recovery codes.
Sources and further reading
Claims checked against these official or professional sources on September 26, 2026.
- NIST — Digital Identity Guidelines: Authentication and Authenticator ManagementCurrent federal technical guidance on passwords, authenticators, recovery, phishing resistance and lifecycle management.
- CISA — Secure Our WorldFederal consumer guidance on strong passwords, password managers, MFA, phishing and software updates.
- CISA — More Than a PasswordCISA consumer guidance on unique passwords and password-manager use.
- CISA — Multifactor AuthenticationCISA guidance on enabling MFA and preferring phishing-resistant options when available.