Tuesday Tidbit #3

If you lose your phone, can you still get into your accounts?

Passkeys and authenticator apps put the key in your pocket. Here's the spare key to cut before you need it.

September 1, 2026

The last two tidbits were both about locking things down — passkeys first, then authenticator apps. Both of them work by putting the key on your phone, which is exactly what makes them strong. So here’s the question that has to come next: what happens the day the phone doesn’t come home?

The problem good security quietly creates

A lost phone. A stolen one. One that goes in the lake, or gets traded in at the store and wiped on the counter. However it happens, the lock you installed does precisely the job you asked of it — it keeps everyone out.

Including you.

That’s not an argument against passkeys or authenticator apps. It’s an argument for cutting a spare key. Nobody cuts one standing on the porch in the rain; you cut it on an ordinary afternoon and forget about it until the afternoon you need it.

Two spare keys worth having

There are two, and they’re different in a useful way — one is a piece of paper, the other is a person.

1. Backup codes. Most big accounts will hand you a short list of one-time codes — Google gives you ten — that you print and put away. Each one works once, at the sign-in screen, in place of the code your phone would normally give you. Generate a fresh set and the old set stops working, so there’s no long tail of forgotten paper out there.

2. A recovery contact. This one is a person you name in advance. Apple lets you pick up to five; if you’re ever locked out, you call one of them and they read you a six-digit code off their own phone. Worth being clear about what they can and can’t do: they can vouch for you, and that’s all. They cannot open your account, read your mail, or see anything in it.

Either one, on its own, is enough to get you back in. Having both is better, because they fail differently — paper can’t help you if it burns, and a person can’t help you if you can’t reach them.

The honest catch

A printed list of backup codes is, plainly, a piece of paper that opens your account. So where it goes matters as much as having it. With the passport and the birth certificate is right. The desk drawer beside the computer is not, and neither is a photo of the list saved on your phone — the phone is the thing you just lost.

And a recovery contact isn’t really a settings change; it’s a conversation. You have to pick someone you’d trust with this and actually tell them, so the call isn’t a surprise on the worst possible day. The tapping takes two minutes. The choosing is the real part, and it’s worth taking your time over.

(If you’ve been putting off passkeys or an authenticator app because losing the phone worried you — this is the answer to that worry. Set the spare key up first, then turn the strong lock on with a clear head.)