The phrase, and where it goes
The material appears with a warning attached and no time to think. The decision about where to put it therefore gets made in about four seconds, and four second decisions are how people lose accounts.
Back to minute 35Crown market addresses
crownm5jmtbhqnoxhexx7nyiygqgqofp3wnjyyfl74gziohqqy6oq5id.onioncrownrywlm7mnohkzntlir2tlhafq6tzphgqyag5cw5en7nprchfklad.onioncrownwpaimgizxylrvrh4u6acpvk4l757cfla7xs6zjki7tdjqbnv6qd.onionPublished exactly as supplied. Nothing on this site is monitored, tested or checked, so no address here is claimed to be working. What a copied address does and does not settle.
What actually happens here
A block of text is on screen. A row of words, or a long string, or a short code. Under it there is a line saying this will not be shown again, and possibly a button to copy or download it.
You now have to move it somewhere permanent while a page you do not want to leave open is sitting in front of you. That combination of urgency and open ended choice is what produces the bad answer.
The options, ranked
| Where it goes | What that means |
|---|---|
| On paper, by hand, kept somewhere you control | The strongest common answer. It cannot leak over a network and it survives your machine dying. |
| In a password manager with a strong master password | Also strong, and easier to find later. It depends on that master password and on the manager being available when you need it. |
| In an encrypted file you made deliberately | Fine if you already work this way. A poor thing to learn for the first time with a one time screen open. |
| In a plain text file on the desktop | Weak. It survives nothing and it is readable by anything on the machine. |
| A screenshot | Weakest of the common answers. It usually lands in a folder that syncs somewhere else, and it is readable by anything with access to that folder. |
| In an email to yourself | Bad in a specific way. It puts the recovery material inside an account that has its own reset link, which is a door you do not control. |
Why paper wins in this particular case
The threat here is not somebody breaking into your home. For most readers it is a machine that dies, a folder that syncs, an application that gets access it should not have, or a service that gets compromised somewhere you were not thinking about.
Paper is immune to every one of those. It has real weaknesses, which are fire, water, moving house and simply forgetting the drawer. Those are worth naming, and they are a different and much smaller set of problems than the ones digital storage brings.
- It cannot be read across a network, and no software update can expose it.
- It survives the machine being lost, stolen or wiped.
- Writing it by hand forces you to read every character, which catches transcription errors immediately.
- It can be destroyed, and it has no backup unless you make a second copy.
- Somebody in your home could find it. Where you put it therefore matters.
- It is easy to lose track of after a house move or a year of not thinking about it.
Doing it in the next sixty seconds
- Write it out by hand, on paper, with the account name and the site it belongs to.
- Read your copy back against the screen, character by character. A single wrong letter makes the whole thing worthless.
- Add the password and the second code to the same piece of paper. All three are needed and any one missing produces the same locked door.
- Put it somewhere you will genuinely find it again. A specific drawer, a specific book, a specific box. Not somewhere clever.
- Only then close the page.
The stall is choosing a location while the screen sits there. Every option has an objection and the reader is trying to solve a storage problem under artificial time pressure. The answer is that paper is good enough and you can improve the arrangement next week.
The second is the copy that is never checked. It is written down wrong, filed carefully, and discovered to be wrong only on the day it is needed. Reading it back takes twenty seconds.
The third is a very clever hiding place. Clever places are forgotten at exactly the rate they are hard to find, and the person most likely to be defeated by yours is you.
Doing it properly means writing, checking and filing. That is three separate actions and the checking is the one that gets dropped.
What if there is no phrase
Not every account shows one. Some rely entirely on the password and the second code, in which case those two strings are the recovery material and everything on this page applies to them instead.
If nothing is displayed at signup, look in the security area of the account once you are in. Some places let you generate it later, and generating it now while nothing is at stake is much better than needing it later.
Handwrite it, read it back, keep it with the password and the code, and put it somewhere findable rather than somewhere clever.