1. That is up to the user. They can save it wherever they like: a secure online storage, a USB, a piece of paper... 2. True but there are a couple of things yo

1. That is up to the user. They can save it wherever they like: a secure online storage, a USB, a piece of paper... 2. True but there are a couple of things you can do: i) regularly remind the user via email and in-app notification to backup their recovery key. ii) force the user to download/copy the recovery key on login/signup. By force, I really do mean force. Don't let the user use the app until they click the download recovery key button.