The problem with storing OTBC on-device is that if your device is compromised software-wise, eg virus infection, trojan, copy attack etc, then you are toast. Provided the passwords: one for Passwords-DB and one for OTBC-DB are not stored outside of my brain, is it the simplest method for managing OTBC and are there any security flaws or hidden risks in this scheme? OTBC-DB <= OTBC for services + OTBC for Passwords-DB So I can either store them outside of the system or in a cross-fashion: Passwords-DB <= passwords for services + OTBC for OTBC-DB They should be stored outside of their respective password manager databases. Now, each of password managers introduces its own set of OTBC (to backup the 2FA for the master password) which cannot be memorized. In result I have the necessity for two separate password managers one for passwords, one for OTBC. So OTBC to respective services cannot be stored alongside their passwords in the password manager otherwise this would render 2FA non-existent. One of 2FA purposes is protection against using passwords obtained by breaching the password manager on non-authenticated devices. It is my understanding that OTBC should be treated with the same level of security precautions as passwords. I assume I may lose all 2FA devices and this should not prevent me from accessing the services using the OTBC. I am considering what is the best practice for securely managing OTBC. Password manager introduced its own set of OTBC. However I am mobile so I cannot use a physical vault (for example to store printed OTBC). I run password manager only on machines I own and manage. I use password manager with 2FA to store all my passwords.

In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-time backup codes (let's call them OTBC). I am already using 31 services with 2nd factor authentication and the number is growing.

Use 1password for 2fa