A Simple Storage Routine for Passkey Backup Codes

Passkeys make signing in faster and reduce reliance on one-time codes, but they come with a quiet catch: if you lose the device that holds the passkey and you never stored the backup codes, regaining access can become a slow and stressful process. Many people set up a passkey in a minute and then never decide where the recovery codes should actually live. This guide is about fixing that gap. It is written for readers in South Africa who use exchanges such as Binance, OKX, Bybit or Bitget, and it treats storage as a small routine rather than a one-off task. You will not find promises here about how quickly a recovery request is handled, because that depends on the exchange and on the evidence you can provide. Instead, you will find concrete steps: where to look for the codes, how to split them across locations, what to write down, how often to check, and when to stop and contact support. The goal is simple: if your phone is lost, stolen or reset, you should know within a few minutes where your backup codes are and whether they are still valid. That certainty is worth more than any clever app.

Find out exactly what your exchange calls a backup code

Before you store anything, open your exchange account settings and locate the security or passkey section. Exchanges do not all use the same words. One platform may call it a recovery code, another a backup code, and a third may present a list of one-time codes generated when the passkey was created. Read the help centre page for your specific exchange so you understand what the code is for: whether it replaces the passkey entirely, whether it only helps you remove a lost passkey, or whether it is a fallback for a single sign-in attempt. Write the exact name your exchange uses on a sticky note or in your notes app, because that label will matter if you ever have to explain the situation to support.

Check whether the codes were shown only once at setup. Many platforms display them a single time and never again. If you skipped that screen, look for a regenerate option in the same security menu. Regenerating usually invalidates the old set, so do not press it casually while travelling or before you have a safe place ready for the new list. If no regenerate option is visible, the help centre is the right place to confirm whether a new set can be issued at all. Record the date you looked and what you saw, even if the answer was that nothing is available. That note becomes useful later.

Also confirm how the passkey itself is stored on your device: in a password manager, in the operating system keychain, or on a hardware security key. The backup code routine changes slightly depending on the answer. If the passkey lives in a synced password manager, losing one device may not lock you out, but you still need the backup codes for the case where the whole account is inaccessible. If it lives on a single hardware key, the backup codes are your only bridge to a new device. Decide which situation applies to you before moving on.

Choose two physical locations and one sealed copy

A workable routine uses at least two separate physical locations that fail independently. For example, one copy at home in a locked drawer and one copy at a trusted family member's house in a different suburb or town. The point is that a fire, flood, burglary or move should not destroy both copies at once. Write the codes by hand on paper rather than storing them only as a photo or a note on the same phone that holds the passkey. A photo on the phone is convenient until the phone is gone, and a note in the same password manager as the passkey is only as safe as that one account.

Make a third copy and seal it. Put the codes in an envelope, write the date and the exchange name on the outside, seal it, and sign across the flap. Store it somewhere you will not be tempted to open casually, such as a home safe or a bank deposit box if you already use one. The sealed copy is your reference point: if the seal is broken and you did not break it, you know the codes may have been seen. This is a simple tamper check that costs nothing. Do not label the envelope with the words backup codes in large letters; use a neutral label and keep a separate note in your records explaining what it is.

For each copy, write down four things: the exchange name, the date the codes were generated, the words your exchange uses for them, and a reminder of what they unlock. Keep the codes themselves on the same sheet but separate them from this description, for example by folding the paper so the description is on the outside and the codes are inside. This matters because a helper or family member may find the paper during an emergency and need to understand what it is without seeing the full code list. Also decide now who, if anyone, is allowed to open the sealed copy. Write that decision down and tell that person where the envelope is, without reading them the codes.

Run a short check every three months

Set a recurring reminder, for example on the first weekend of January, April, July and October. On that day, do four things. First, confirm that the passkey still works by signing in on a device you already trust. Second, check whether the exchange has changed how passkeys or recovery codes work by reading the relevant help centre article. Third, look at your sealed envelope and confirm the seal is intact and the date on it is still the most recent generation. Fourth, update your written record with the date of the check and anything that changed. The whole routine should take under fifteen minutes.

If you regenerate your backup codes, the old copies become misleading. Do not simply add the new sheet on top of the old one. Destroy the old copies properly, for example by shredding or burning the paper, and replace all three locations on the same day so you never have a mix of valid and invalid codes in circulation. Write the destruction date in your record. If you cannot replace all three copies on the same day, replace the sealed copy first, because that is the one you will reach for in an emergency.

Use the same check to review whether the people who need to know still know. If you moved house, changed phone number or ended a relationship, the person holding your second copy may no longer be the right person. Update that arrangement deliberately rather than leaving it to chance. Also check that your exchange account still has a current email address and phone number, because recovery often starts with a message to one of those. A backup code routine is only as strong as the contact details attached to the account.

Know when to stop and contact support

Stop and open a support ticket if any of these happen: the sealed envelope is missing or visibly opened, you cannot find any copy of the codes, the passkey no longer works on any device, or you notice sign-in attempts you do not recognise. Do not keep trying random codes, and do not ask strangers in chat groups for help. Go to the official help centre for your exchange and follow the account recovery process described there. Have your identification documents, your account email and your written record ready before you start, because support will usually ask you to confirm details about the account.

While you wait for a response, do not create a second account to work around the problem, and do not move funds to an unfamiliar address under pressure. If you still have access to the account on one device, consider whether any withdrawal or API permissions should be paused, and check the security settings page for active sessions you do not recognise. Record the ticket number, the date you submitted it and what you were told. That record helps if the conversation continues over several days or is handed to a different support agent.

Finally, treat the first successful recovery as a prompt to rebuild the routine from scratch. Generate a fresh set of codes if the exchange allows it, replace all three physical copies, reseal the envelope with a new date, and tell the person who holds the second copy that the old sheet is void. A storage routine is not a one-time setup; it is a small habit that keeps your access path clear. If you maintain it, a lost phone becomes an inconvenience rather than a crisis.

Risk boundary: South Africa Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Confirm the exact name your exchange uses for passkey backup or recovery codes by reading its help centre page.
• Write the codes by hand on paper and store two copies in separate physical locations that fail independently.
• Seal a third copy in a dated, signed envelope and store it somewhere you will not open casually.
• Record the exchange name, generation date, code label and what the codes unlock, separately from the codes themselves.
• Set a reminder every three months to test the passkey, check the seal and update your written record.
• If a copy is lost, opened or invalidated, stop guessing and open a support ticket through the official help centre.