What still belongs on paper

After the holidays I spent an evening copying out codes. By hand, with a pen, on paper. Then I deleted the photos that had been the only copy until that point, and put the paper in a place I will not name here.

That sounds like the opposite of everything in this series. For six weeks it has been about automation, APIs, an AI agent that manages servers. And now: handwriting. This Sunday edition explains why exactly this is the most carefully thought-out part of the whole setup.

Every chain hangs from a hook

A digital security system is a chain of references: the account is protected by a password, the passwords are protected by a password manager, the password manager is protected by a master key, and for emergencies there are recovery codes. Each link hangs from the next.

But every chain ends somewhere. There is a last link that can no longer be secured digitally — otherwise you would only have created another link. In the trade, that last link is called the root of trust, and the decisive question of any setup is: where does it live, and what happens when it is gone?

Storing it inside the system itself builds a circle: the codes meant to rescue your access when the password manager won’t open are stored — in the password manager. You notice exactly when it is too late. The classic is the work phone with the authenticator app: phone breaks, and the app guarding access to everything is itself the total failure.

Why paper is unbeatable here

For this one, final link, paper has properties no digital medium offers:

1. It is offline. No attacker in the world reaches it over a network. The entire category of “remote access” simply does not apply.
2. It needs nothing. No power, no operating system, no file format nobody can read in ten years, no company that has to keep a service running.
3. It fails visibly. Paper is there or it is not. It does not go silently corrupt, does not expire unnoticed, does not accidentally sync itself into a cloud.

The same properties make it useless as storage for everything else — not searchable, not versionable, not backupable, invisible to an agent. Which is precisely where the rule comes from: paper gets only what holds the chain. Nothing else.

What is on our list — and what is not

During the rebuild, a list grew alongside it: “belongs on paper”. Every time recovery codes appeared somewhere, an entry was added; they were worked through in a batch, on that evening after the holidays. On it — as categories, of course:

• Recovery codes for the central identity — the way back when fingerprint and passkey are not available.
• The master key that opens the encrypted secrets of the infra repo — the one secret that guards all other secrets.
• The emergency codes of the most important external accounts: domains, servers, payments.

And at least as important, what is not on it: no everyday passwords (that is what the password manager is for), no customer data, no tokens, nothing that rotates regularly. Paper you would have to update monthly is dead documentation by the second week.

Two craft rules have proven themselves: write by hand instead of printing — a printer is a computer with a spooler, a cache and a Wi-Fi module; the pen has no buffer. And delete the photo afterwards: a photographed recovery code is not a paper backup, it is a cloud backup with a detour — it sat in the photo library for weeks, which was the actual trigger for that evening.

The fire drill, as a thought experiment

The test that shaped the list is a single question: if the password manager locks me out tonight — account suspended, device broken, provider gone — how do I get back into my digital life tomorrow?

The answer has to be a path that does not lead through the locked system. For us: fetch the paper, restore the central identity, rebuild the chain from there. Duration: one morning. Without the paper: an odyssey of support tickets, identity proofs and services where “restore account” is a euphemism for “start over”.

That the most digital setup of all needs an analog anchor is not a contradiction — it is architecture: for each link you choose the medium whose failure modes you can afford. For the root of trust those are the failure modes of paper — fire and loss — against which a second sheet in a second place helps. Against the failure modes of the digital world, at the last link, nothing helps.

The Sunday question

You can guess it already. Your password manager locks you out tonight. Or your Microsoft account. Or your work phone. Do you know where your way back lies? And does it really not lead through the system that just closed?

The Sunday edition appears every Sunday. Next week: two months of “Own Your Stack” — what you have been reading, in numbers.