Where to store your Apple Account recovery key (and what if you lose it)

A recovery key is an optional 28-character code that Apple describes as something you can use, together with a trusted phone number and an Apple device, to regain access to your Apple Account. It is not your password and not a verification code that arrives by text.

It matters because of a trade-off Apple states plainly: if you set up a recovery key and cannot provide it when you lose access to your account, you can be locked out permanently. The key is also one of the two alternative recovery methods Apple asks for when you turn on Advanced Data Protection for iCloud, because Apple then cannot help recover that end-to-end encrypted data. The other method is a recovery contact, a trusted person who can help you regain access without getting access to your account themselves.

1. 1Open Settings and tap your name.
2. 2Go to Sign-In & Security, then Recovery Key. On some iOS versions the entry sits under Account Recovery.
3. 3Turn on the recovery key and enter your iPhone passcode when asked.
4. 4Write the 28 characters down exactly as shown, then confirm the key to finish setup.

To get a new key, open the same settings and choose Replace Recovery Key. Do this if you lost the paper, or if you think someone has seen the key. You must still be signed in to do it, which is why a lost key is far easier to fix before you are locked out than after.

Apple's own advice is to keep a copy in a safe place, ideally in more than one location, and not to store it in apps that depend on the account, such as Passwords, Photos, Notes or iCloud Drive. The reason is simple. If you are locked out, you cannot open those apps to find it.

• Best primary copy: the 28 characters written by hand on paper, kept with other important documents at home, or in a safe. A paper copy does not need a battery, a signal or a login.
• A second copy in a different place: a relative's home, or a safe deposit box. Do not label it "Apple key" if the paper could be read by a visitor.
• A second digital copy only if it is encrypted and does not need your Apple Account to open, such as a password manager or an encrypted vault with its own passcode.
• Not recommended as the only copy: a screenshot, a photo, an open note, an email to yourself or a chat. Anyone with your unlocked phone can read these, and photos and notes sync to other devices.

Yes, as a second copy. The weakness is the same for every phone-based place: if the vault lives only on the iPhone you lost, the copy went with it. A digital copy helps only if the vault is backed up, or can be opened on another device.

That is why the paper copy comes first. The digital copy is the convenient one: it is what you open when you replace a phone or when you want to check a character. Treat the two as a pair.

• If you can still sign in on a trusted device, open the recovery key settings and choose Replace Recovery Key. Write the new key down at once, and destroy the old paper.
• If you are already locked out and the key is gone, tell Apple Support. Apple warns that the account may not be recoverable, so do not wait until you are locked out to find out.
• If you turned on a recovery key only to be safe and you are not sure you can keep it, a recovery contact, or no recovery key, may suit you better. Weigh this before you set it up, not after.
• While you are at it, check your trusted phone number is current. The key works together with it.

See what happens to your iPhone data when you die if you also want a trusted person to be able to access your account.

Lockboxy is a private, encrypted vault app for iPhone. Its Wallet can keep the key as a Password entry: put "Apple Account" or a neutral label in the service name, the Apple Account email in the username field and the 28 characters in the password field. Everything is encrypted with AES-256-GCM on your device behind a passcode of its own. There is no account, and no server holds a copy.

1. 1Open Lockboxy with its passcode and go to the Wallet tab.
2. 2Tap Add entry and choose Password.
3. 3Fill in the service name, the username and the key. Use the Notes field for a reminder of where the paper copy is.
4. 4Save. Tap Show when you need to read it, or Copy to paste it. Lockboxy clears a copied value from the clipboard about 30 seconds later.

Because the vault lives on the phone, keep it recoverable. Lockboxy's Premium plan can create an encrypted backup file you save to iCloud Drive, Google Drive or Files, and a Recovery Key for the vault itself. Neither replaces the paper copy of your Apple recovery key, and the backup opens only with your vault passcode or vault Recovery Key. What Premium adds is on the Premium page.

• Lockboxy is not affiliated with Apple. It stores the code you type in, and it cannot reset, replace or check an Apple Account recovery key for you.
• If you forget the vault passcode, nobody can open it, including us. See what to do if you forgot a vault app's passcode.
• Wallet entries are unlimited on the free plan. The app shows the exact price of Premium before you buy.
• If you think the key has been seen, replace it. A vault does not make a leaked key safe again.

More answers are in the Lockboxy FAQ.