Account Recovery
How to Create an Emergency Password Recovery Plan
An emergency password recovery plan helps you regain access when a phone is lost, an account is locked, or a family member needs authorized help. This guide explains what to prepare without weakening security.
Plan before the emergency
To create an emergency password recovery plan, identify your critical accounts, secure your primary email, enable MFA, store backup codes safely, keep recovery email and phone current, and decide who is authorized to help if you cannot access accounts yourself.
The plan should not expose all of your passwords to someone else. It should explain how to recover access safely through official channels when something goes wrong.
This matters after a lost phone, locked password manager, suspicious login, illness, travel problem, device theft, or family emergency.
What belongs in the plan
The plan should list critical accounts, not necessarily passwords. Include where credentials are stored, which recovery email and phone are used, whether MFA is enabled, where backup codes are stored, and who can help.
NIST recommends password managers for strong unique passwords. A password manager can be the center of the plan if its own recovery is well understood.
CISA recommends MFA, but MFA also needs backup planning so a lost device does not lock you out.
- Primary email.
- Password manager.
- Banking and payments.
- Cloud storage.
- Phone carrier.
- Work or business tools.
- Government and tax accounts.
- Emergency contacts.
Avoid making the plan a security weakness
Do not keep a plain-text master password list in a shared document or email draft. Do not give recovery codes to people who do not need them. Do not store account secrets where a stolen device exposes everything.
The plan should help trusted recovery, not create an easy theft path.
Secure the primary email first
Your primary email controls resets for many services. Use a unique password, MFA, current recovery methods, and reviewed sessions.
The FTC highlights email recovery as central when accounts are compromised.
Prepare password manager recovery
Understand how your password manager handles recovery, trusted devices, emergency access, recovery keys, or backup codes. Store recovery information securely.
Review it after changing phones, devices, or email addresses.
Store backup codes safely
Generate backup codes for important accounts where available. Store them in a protected place that you can access during device loss but that others cannot easily steal.
Update them after use or after a security event.
Choose authorized helpers carefully
If a family member, partner, or business associate may need to help, document what they are allowed to do. Use official delegated access or emergency access features where possible.
Do not share one-time codes casually. Authorization should be intentional.
Review the plan twice a year
Recovery plans become stale when phone numbers, emails, jobs, devices, and relationships change. Review twice a year and after major life changes.
A working plan should be short, current, and easy to follow under stress.
Frequently asked questions
Should my emergency plan include every password?
No. It should explain where credentials and recovery methods are stored securely, not expose every secret.
Who should have access to my recovery plan?
Only trusted, authorized people who genuinely need emergency access, and only to the level required.
How often should I review it?
At least twice a year and after changing phones, email addresses, jobs, devices, or important accounts.
Sources
This guide is reviewed against official guidance. External pages may be updated by their respective owners.