BackupCodes

Backup codes are a set of codes issued by an online service when you enable two-factor authentication (2FA). They provide a fallback method to regain access to an account if you cannot use your usual second factor, such as your authenticator app or SMS verification.

Most backup code sets consist of a limited number of codes, typically 8 to 12, each of which is a short alphanumeric or numeric string. Codes are usually single-use; once you redeem one code, it should no longer be accepted. Some services allow generating a fresh set of codes after a code is used or if you suspect the codes have been compromised. They are commonly provided as a downloadable file or printable list.

Usage involves entering a backup code during the sign-in process when you cannot access your primary 2FA method. This allows you to authenticate without the usual second factor, letting you regain access and then reconfigure 2FA as needed. Backup codes should be stored securely and kept separate from your everyday devices, ideally in a password manager, a printed copy kept in a secure location, or another offline secure storage method.

Security considerations emphasize treating backup codes as highly sensitive credentials. Do not store them in easily accessible places, such as plain text files on devices connected to the internet, or share them with others. If you suspect exposure or if you have used several codes, generate a new set and revoke the old ones. If you lose all backup codes and cannot access the account, you may need to go through the service’s account recovery process.