Know what your recovery key and backup codes do
If you're locked out, it helps to know which code to reach for. Your encryption recovery key helps unlock Notes and Vault after a password reset. A sign-in backup code replaces the extra code from your authenticator app. A personal-backup password opens a backup file you downloaded. Keep them clearly labelled so you don't mix them up.
1. Give each saved secret a clear label
Include the service name and what it is: encryption recovery key, two-factor sign-in backup codes or personal-backup password. A note called recovery is easy to mix up later. Keep the actual secrets out of screenshots, help requests and examples you share.
2. Keep copies you can reach when locked out
Store the recovery key and sign-in backup codes separately in protected places outside this account. Your only copies shouldn't be in the Vault they help you get back into. Think about what you could still reach if your phone, laptop or email account were unavailable.
3. Check the recovery key you saved
While signed in, open Account and find Recovery checkup. Enter your saved key and press Check recovery key. Your browser checks whether it matches the current account encryption key. Nothing is reset or changed. A match tells you the saved key works now, though it doesn't test the whole account-recovery process.
4. Save sign-in backup codes when they appear
After you confirm two-factor setup with your authenticator app, download or print the backup codes. The site can't show those same codes again, and each works once. Keep the file private and label it so you don't confuse it with codes for another service.
5. Replace saved copies when you change setup
A new encryption recovery key makes the old one stop working, so update your saved copies. Setting up two-factor sign-in again makes a new set of backup codes. Don't turn it off just to test it. Read the Account instructions and keep a working way to sign in before changing the setup.
Good to know
Resetting sign-in access doesn't by itself unlock your saved content. If you lose both the password and encryption recovery key, the server can't recover the readable contents of Notes or Vault. Checking your recovery key also can't recover a forgotten personal-backup password.