Rotate Recovery Codes After One Is Used on a Household Account
Replace a household account's recovery-code set after use without exposing the new codes or leaving one person as the only gatekeeper.
Use a recovery code once, then replace the set and update the household’s sealed copy. Do not cross out one line and leave the remaining codes in a group chat, shared note, or kitchen drawer. A recovery code can bypass the normal second factor, so the household should treat every unused code like a spare key.
This procedure is for a genuinely shared service, such as the internet provider, alarm, utility, or household scheduling account. It is not permission to collect recovery codes for anyone’s personal email, banking, work, or social account.
Close the Used Set Immediately
The person who used the code should sign in from a trusted device, confirm that the account activity was legitimate, and open the provider’s security settings. Generate a new set if the service offers that option. Google, for example, says that creating a new set makes the old set inactive, and explains that each backup code can be used only once in its official backup code instructions.
Do not announce the actual codes in the household chat. Post a status such as “recovery set replaced at 7:15 p.m.” instead. If the code was needed because a phone disappeared, an account steward left, or an unexpected prompt appeared, also review signed-in devices, recovery email addresses, phone numbers, passkeys, and authenticator enrollments. A routine lockout and a suspected takeover need different responses.
If the provider does not let you regenerate codes, mark the used code as spent on the protected master copy. Never edit an unencrypted photo or cloud note that may preserve previous versions.
Make a Two-Person Replacement Handoff
Assign two named stewards rather than making one person the permanent gatekeeper. One steward generates the replacement set. The other verifies the service name, generation date, number of codes, and storage destination without copying the codes into a message.
Keep one encrypted digital copy in the household password manager if all authorized stewards can reach it without depending on the locked account. Keep a second copy in a sealed envelope in a locked, agreed location if the household needs an offline fallback. Label the envelope with the service and replacement date, not with usernames or passwords visible from outside.
Record only safe metadata in your household system:
- service name and account owner
- date the set was generated
- names of the two stewards
- location of the sealed or encrypted copy
- next review date
Do not store the recovery code beside the password when one lost paper would expose both factors. For the broader setup, use HomeCo’s guide to two-factor authentication for shared household accounts.
Test the Route Without Burning Another Code
A good test checks access to the instructions and storage location, not whether a live code works. Ask the backup steward to explain where the codes are, how to identify the correct envelope or vault item, and whom to notify before using one. Confirm that the person can unlock the password manager or physical lockbox independently.
Run this metadata-only check after a move, account-owner change, password-manager migration, or change in the household’s trusted relationships. Also inspect the envelope seal. If anyone photographed, copied, or temporarily removed the codes, replace the set rather than debating whether exposure “probably” occurred.
One code use should create one short incident entry: who used it, when, why, whether the sign-in was expected, and when replacement finished. Keep that entry free of secrets.
How HomeCo Helps
HomeCo can turn this procedure into assigned, visible household work. Create a private task for the generating steward, a verification task for the second steward, and a recurring review that records only dates and storage status. Household members can see that recovery coverage exists without seeing the codes themselves.
Use a clear completion rule: the task is done only when old codes are invalidated, the new set is protected, the second steward has verified the route, and the safe metadata is current. That keeps “I generated them” from becoming a half-finished security handoff.
FAQ
Should every housemate receive a copy?
No. Give access only to people who are authorized to administer that service. Wider copying creates more loss points and makes offboarding harder.
Can we keep a photo of the codes?
Avoid ordinary camera rolls and shared photo libraries. If you need a digital copy, store it in an encrypted vault with restricted membership and a separate recovery route.
What if a code was used unexpectedly?
Treat it as a possible account compromise. Change the password, regenerate codes, review active sessions and recovery methods, remove unknown access, and contact the provider if anything is unclear.