Nirmion
HelpLog in Find a tool

Security & Privacy · THE NO-PANIC PLAN

Create and test a personal account recovery plan

Make this plan while you can still sign in. It is for personal accounts; work or school accounts may require an administrator. Recovery features differ by provider and can have delayed activation or irreversible trade-offs. The plan should store where recovery instructions and codes are kept, not the passwords, one-time codes or secret answers themselves. Never send recovery codes or authentication codes to someone who contacts you unexpectedly, and never store every backup on the same phone or computer whose loss could lock you out.

MISSION Help people prevent lockout of important personal accounts by documenting provider-approved recovery methods, protecting backup codes and testing a fallback safely.

Review the official recovery settings for your most important account

THE REAL-WORLD BIT

What happens outside this browser tab?

List critical accounts and identify which accounts are needed to recover others; read each provider's current official recovery settings; add at least one reachable recovery route and multifactor authentication where offered; generate and store provider-issued backup codes or keys using that provider's warnings; test the documented fallback from a trusted second device, record the test date, and review the plan whenever a device, phone number, recovery contact or account owner changes.

YOUR CHECKLIST, WITH FEWER DRAMATIC SIGHES

One step at a time.

Follow the order below. If a step names a Nirmion tool, its link is right there with it.

  1. 01

    Inventory accounts and map recovery dependencies

    Start with accounts whose loss would block other accounts or cause serious harm: your primary email, password manager, mobile-carrier account, financial accounts, cloud storage and identity or government portals. For each one, record the provider name, sign-in URL reached from its official site, recovery-help URL, recovery email/phone/contact that you can currently access, and the date you checked it. Mark dependencies—for example, whether your recovery email itself depends on the same phone. Do not write current passwords, full card numbers, backup codes or answers to security questions into this inventory. If an account belongs to an employer, school or family organizer, note the official administrator or organizer recovery route instead of assuming personal settings apply.

  2. 02

    Check and strengthen each provider's recovery settings

    While signed in through the provider's official website or app, open its Security or Sign-in settings and confirm that every listed recovery email and phone still belongs to you and can receive messages. Add a second recovery method or a trusted contact if the provider supports one and you understand the contact's role. Turn on multifactor authentication where available, choosing a strong method supported by that service and keeping a separate fallback. Check provider-specific consequences before enabling a recovery key: Apple warns that its recovery key disables Apple's standard account-recovery process and that losing the key can lock you out permanently. Google's recovery-information changes can take time to take effect, so do not assume a newly added method works immediately.

  3. 03

    Create provider-issued backup codes and protect them separately

    Use each provider's official instructions to generate its own backup codes or recovery code; these are not interchangeable between services. For Google, backup codes work as an alternate second step, each used code becomes inactive, and generating a new set disables the old set. For Microsoft, a recovery code cannot be retrieved later, and Microsoft advises storing it away from devices used to sign in. Keep a paper copy in a private, physically secure place or another provider-approved protected store, and make sure your plan says how you can reach it if your phone is lost. Never paste codes into this workflow, email them to yourself, send them to support, or upload them to a general-purpose Nirmion tool.

  4. 04

    Test the fallback without risking your only working sign-in

    Follow the provider's documented recovery or backup-code test using a trusted second device or browser while your normal signed-in device remains available. Confirm that the recovery email/phone is reachable and that the provider recognizes the backup method; do not intentionally sign out everywhere or consume your only code just to test it. If an authenticator app is part of the plan, check its own backup limits before replacing a phone: Microsoft Authenticator, for example, documents that backup restoration is restricted to the same device type and that some work or school accounts must be signed in again. If a route fails, use the provider's official help flow and keep the existing working session until a replacement method has been confirmed.

  5. 05

    Record the plan and review it after every security change

    Store a short recovery map with each account's official help route, the location of its backup codes (not the codes), the person or administrator to contact, important provider-specific warnings and the date the route was last tested. Review it after changing a phone, losing a device, replacing an authenticator, changing a recovery contact, moving a password manager or receiving a provider security notice. If a code or key may have been exposed or used, sign in through the official account settings and replace/revoke it; old Google backup codes are invalidated when a new set is generated. Re-test only the new route and update the plan. The task is complete when the critical accounts each have a reachable, documented fallback and you have confirmed how to access it without relying on the device most likely to be lost.

RECEIPTS, PLEASE

Sources & review notes

Each source is linked to the steps it supports. Open it to check its scope and current guidance.

Source checked 2026-10-05