Replace an Apple Account Recovery Key After It Was Shared

If another person has seen, copied, photographed, or stored your Apple Account recovery key, replace the key from a trusted device. Do not merely move the exposed copy to a better folder. Apple provides a Replace Recovery Key control that generates a new key.

A recovery key is not a household password. One person may help another print it or place it in secure storage, but that helper should not quietly keep a copy. When custody becomes uncertain, replacement creates a clear new boundary.

Confirm what was exposed before acting

First distinguish an Apple Account recovery key from a device passcode, FileVault recovery key, recovery contact code, or one-time verification code. Similar language does not make these credentials interchangeable. This procedure concerns the 28-character Apple Account recovery key described in Apple’s support guidance.

Write down how exposure occurred without copying the key into the note. Useful facts include who may have seen it, where it was saved, whether a photo or printout exists, and when the exposure happened. If an unfamiliar person may also control a trusted device or know the account password, treat that as a wider account-security incident rather than a storage mistake.

Use a trusted iPhone, iPad, or Mac and navigate to the recovery-key settings through the operating system. Do not follow a link from an unexpected text or email. Apple’s official instructions explain where the control appears and state that you can select Replace Recovery Key after recovery-key protection is already set up.

Generate and store the replacement safely

Replace the key while the account holder is present and able to complete the device authentication. Accurately record the new key in a location the account holder controls. Confirm the stored copy character by character before closing the settings screen.

Keep the new key somewhere separate from the trusted Apple devices it may need to recover. A locked physical record or a carefully managed secure vault may work, depending on the person’s needs. A shared household note, group chat, unencrypted photo library, or label attached to the device does not create meaningful separation.

Do not announce the key in a HomeCo task or household message. Record only that replacement was completed, who owns the follow-up, and where the account holder’s own storage policy says the key belongs. The storage location description should not reveal the key itself.

Collect old paper copies and delete known digital copies after the replacement is safely recorded. Emptying a device’s deleted-items folder may be appropriate, but do not claim that every prior copy has vanished. Replacement is the decisive control because an exposed secret cannot be made secret again.

Separate help from permanent custody

If a family member needs recovery help, decide in advance whether that person should be an Apple recovery contact rather than a keeper of the recovery key. Apple treats those as different recovery methods. A recovery contact can generate a code when asked, but does not automatically gain access to the account.

Never make an informal custodian the only person who understands the arrangement. Record a plain-language instruction that says whom to contact and what official recovery path to use, without recording secrets.

Review other recovery surfaces after a breakup, roommate departure, caregiver change, or estate-plan update. HomeCo’s checklist for how to remove a former housemate from recovery emails and phone numbers covers a separate risk. Replacing a key does not remove an old recovery address, trusted phone number, or signed-in device.

FAQ

Is moving the exposed key to a locked drawer enough?

No. A person or camera may already hold a copy. Replace the key, verify the new record, and then clean up old copies.

Can I send the new key to myself by email?

That creates another account and inbox that can expose it. Use a storage method designed for a high-value recovery secret and keep it separate from the devices being recovered.

Is a recovery contact the same as sharing the key?

No. Apple documents recovery contacts as people who can provide a recovery code. They do not need a copy of your recovery key.

How HomeCo helps

Use HomeCo to assign the nonsecret work: schedule the replacement, note that the account holder verified storage, and set a review after household access changes. Keep the actual recovery key out of HomeCo descriptions, comments, and attachments.

A short completion record prevents repeated handling of the secret. It also lets the household coordinate help without turning a private account-recovery credential into communal information.

Source: Apple Support, Set up a recovery key for your Apple Account