Two-factor authentication has quietly become the default way to protect important accounts, and rightly so: requiring a second step beyond the password stops the great majority of account takeovers, because a stolen password alone is no longer enough. Most people, prompted by their bank, their email provider or their work systems, have now switched it on. But there is a step in the setup that almost everyone rushes past, and it is the step that matters most on the day something goes wrong: saving the backup codes.
The reason backup codes exist is that the second factor is usually tied to a single device - the phone in your pocket. That works beautifully until the phone is lost, stolen, dropped in water, wiped, or simply replaced with a new one that never received the old codes. At that moment the very security that was protecting the account turns against its owner: the system correctly refuses to let anyone in without the second factor, and the legitimate owner no longer has it. People discover this at the worst possible time, locked out of their own email or bank with no obvious way back in, and the recovery process - proving who you are to a support desk - can take days or fail entirely.
Backup codes are the answer the system already gave you, and they are handed over at setup precisely for this scenario. They are a short list of one-time codes that work in place of the phone, each usable once, meant to be printed or written down and kept somewhere safe and separate from the device itself. Stored properly - on paper in a drawer, in a sealed note, in a password manager that you can reach from another device - they turn a lost phone from a catastrophe into a five-minute inconvenience. Stored badly, or not at all, they leave nothing between you and a lockout.
The practical discipline is small and worth building into the habit of turning on two-factor in the first place. When an account offers backup codes, take them then, not later - later rarely comes. Keep them somewhere you will still be able to reach if the phone is the thing that failed, which rules out saving them only on that same phone. Treat them as seriously as the password, because anyone who has them can also get in. And when you use one during a real lockout, generate a fresh set afterwards. None of this is difficult; it is simply the difference between having a spare key and being locked out of your own house because the only key was on the ring you dropped down the drain.