2FA Backup Codes: What They Are and How to Store Them Safely

When you turn on two-factor authentication, most services show you a short list of codes and ask you to save them. Many people click past that screen, or take a screenshot that ends up on the very phone the codes are meant to replace. Then the phone breaks, and the codes are nowhere to be found.

Backup codes are the cheapest insurance you can have for your accounts. This article explains what they are, how they work, where to find them, and how to store them so they're available when you need them and useless to anyone else.

What Are 2FA Backup Codes?

Backup codes (also called recovery codes) are a set of pre-generated, single-use codes that can stand in for your normal second factor. If you can't get a code from your authenticator app, can't receive an SMS, or don't have your security key with you, you type one of these codes instead.

They are generated by the service, not by your authenticator app, and they're tied to your account. They are not related to the secret key behind your TOTP codes, so having them doesn't let anyone generate your 6-digit codes, and losing your authenticator doesn't invalidate them.

One-time use

Each backup code works only once. After you use it, the service marks it as spent. This limits the damage if a single code is exposed, and it is why you should keep track of how many you have left.

How many you get

The number and format vary by service. Some common examples:

• Google provides a set of 10 backup codes, each 8 digits long.
• GitHub provides 16 recovery codes.
• Microsoft personal accounts use a single, longer recovery code rather than a list. When you use it, you get a new one.
• Apple doesn't use backup codes; instead it offers an optional recovery key and recovery contacts.

Services change these details occasionally, so check what your account actually shows you.

What they are not

Backup codes are not a password replacement. On most services you still need your password and then enter a backup code at the 2FA step. They also aren't the same as an account recovery process; they let you skip that process entirely, which is why they're so valuable.

Where to Find or Regenerate Your Codes

Backup codes live in the security or two-factor section of your account settings. Menu names may vary slightly by version, but the path usually looks like one of these:

• Google: Google Account, Security, 2-Step Verification, Backup codes.
• Microsoft: Microsoft account, Security, Advanced security options, recovery code.
• GitHub: Settings, Password and authentication, Recovery codes.
• Facebook/Instagram: Accounts Center, Password and security, Two-factor authentication, then the account and "Recovery codes" or "Additional methods".

Some services let you view existing unused codes again. Others only show them once, and you have to generate a new set if you lose them. Generating a new set almost always invalidates the old one, which matters if you have copies stored in several places.

Storage Options Compared

A good storage place meets three conditions: you can reach it without your phone, it survives the loss of any one device, and a stranger who finds it can't easily use it. No single option is perfect, so here is how the common choices stack up.

Paper, done properly

Print the codes or write them by hand. Label each sheet with the service and account name, but don't write your password on the same page. Keep it with other important documents, such as in a locked drawer or a home safe. Some people keep a second copy at a trusted relative's place for fire or flood protection.

Password manager, done properly

Store the codes in a secure note or a custom field attached to the matching login entry. This works well for most accounts. The exception is the password manager's own backup codes and the backup codes for the email account that recovers it. Those should also exist outside the password manager, on paper or in a separate encrypted file, so a problem with one doesn't lock you out of both.

Encrypted file, done properly

Use a tool with strong, well-known encryption, such as an encrypted archive or an encrypted disk image, and a long passphrase you will remember. Keep copies on more than one medium, for example a USB drive and a cloud folder. Test opening it once a year.

Mistakes to Avoid

• Storing codes only on your phone. The phone is the thing most likely to go missing when you need them.
• Leaving codes in your Downloads folder. Many services offer a .txt download. That file often sits unencrypted, gets synced, and is forgotten.
• Keeping codes in plain email. Your inbox is the master key to your other accounts.
• Not tracking used codes. Cross off each code when you use it, so you know when you're running low.
• Keeping old sets after regenerating. Outdated copies cause confusion during a stressful lockout. Destroy them.
• Sharing codes with support agents or "helpers". Legitimate services don't ask for your backup codes by phone, chat, or email. Anyone who does is attempting to take over your account.
• Skipping codes for important accounts. Email, your password manager, your domain registrar, and financial accounts deserve codes most.

After You Use a Backup Code

Using a backup code usually means something went wrong with your main second factor. Once you're in:

1. Fix the underlying problem: set up your authenticator on a new device or register a new security key.
2. Check how many codes you have left. If you're down to a few, generate a fresh set.
3. Replace every stored copy with the new set and destroy the old ones.
4. Review recent sign-in activity to confirm that only you have been using the account.

Backup Codes and Saved Secret Keys

Backup codes get you into one account a limited number of times. A saved TOTP secret key is different: it lets you recreate the authenticator entry and generate codes indefinitely. Both are useful, and many people keep both. If you save secret keys, for example in an encrypted 2FA vault, treat them as more sensitive than backup codes, because anyone who has a key can produce valid codes for as long as it's active.

FAQ

Do backup codes expire?

Generally they stay valid until you use them or generate a new set. Some services may invalidate them after certain security events, so check after any major account change.

Can someone log in with just my backup codes?

On most services they also need your password. Still, codes reduce your account to a single factor, so protect them as you would a password.

Is a screenshot in my photo gallery good enough?

It's better than nothing, but it's on the device you're most likely to lose, and photos often sync to cloud albums without extra protection. Move the codes to paper or a password manager.

I never saved my codes. What now?

If you can still sign in, go to your account's security settings today and generate a new set. Most services let you do this any time while you have access.