The recovery key is a long random key, generated once, shown once. It signs you in when the password and the second factor are both gone.

Where to keep it

Somewhere physical, or in a password manager that is not protected by the account it would rescue. Two copies in two places is not excessive for something that has exactly one job and gets used at the worst moment of the year.

What it can do

Sign in. From there you can set a new password and register a new second factor.

What it cannot do

Bring back a lost mailbox key, or decrypt anything that was encrypted to a PGP key you no longer have. Encryption keys and account access are separate things, deliberately.

Regenerating it

You can generate a new one from Security, which immediately invalidates the old one. Do that if you have any doubt about where the old copy ended up, and remember that the old paper is now worthless rather than dangerous, which is the right way round.

If you never saved one

Save one now. It takes a minute, and it is the difference between the last section of I cannot get into my account applying to you or not.