Short answer: backup codes are single-use passwords a service issues when you turn on two-factor authentication. Each one works exactly once, in place of a six-digit code, and they exist for one situation: your authenticator is gone. Store them offline or in an encrypted password manager — never as a screenshot in your photo library.
Most people accept the codes, skim past them, and never think about them again. Then they lose a phone and discover their only copy was on that phone.
What backup codes actually are
When you enable 2FA, most services show you a list of eight to ten codes, usually eight to sixteen characters each. They are not TOTP codes. Three differences matter:
- They do not expire. A TOTP code lives 30 seconds. A backup code stays valid until you use it or regenerate the set.
- Each works once. Use one and it is permanently dead. This is a feature — a stolen code that has already been spent is worthless.
- They are not derived from your secret key. They are randomly generated and stored server-side, which is why they still work when your authenticator does not.
That last point is the important one. Backup codes bypass your authenticator entirely, so they work even if your phone is at the bottom of a river. If you are unsure how the app side of this works, start with our explainer on what an authenticator app is.
Why this matters more than people think
Account recovery without backup codes is genuinely painful. Large platforms may take days or weeks to verify your identity through support. Some services — particularly crypto exchanges and smaller SaaS tools — offer no human recovery path at all. No codes means no account, permanently.
The five minutes you spend storing these properly is the cheapest insurance in your entire security setup. If you have already lost access, our guide on recovering accounts after losing your 2FA phone covers what to do next.
Where to store backup codes — ranked
1. Printed on paper, stored physically (best for high-value accounts)
Print them, write the account name at the top, and put them somewhere you would keep a passport — a safe, a locked drawer, or with a trusted family member. Paper cannot be remotely hacked, does not need a battery, and survives every device failure.
The obvious weakness is fire, flood, and theft. Two copies in two locations solves this, and it is worth planning where the second copy lives before you travel, as our guide to using 2FA when travelling explains. For anything financially significant, this is the method to use.
2. An encrypted password manager (best for everyday use)
Store them in the secure-notes field of a reputable password manager. They are encrypted at rest, synced across devices, and available when you need them.
One serious caveat: do not store your only backup codes inside the same password manager those codes protect. If your manager itself has 2FA and you get locked out of it, your recovery codes are trapped inside the thing you cannot open. Keep your password manager’s own backup codes on paper.
3. An encrypted file on offline storage (fine, with discipline)
An encrypted archive or a VeraCrypt volume on a USB drive kept in a drawer works well. The risk is human: encrypted files get forgotten, passphrases get lost, and USB drives fail silently after years unused. Test it occasionally.
4. Screenshots, notes apps, and email (do not)
This is what most people actually do, and it is the worst option:
- Screenshots sync to cloud photo libraries, often shared with family, and are readable by any app with photo permissions.
- Plain notes apps are usually unencrypted and sync to accounts that may themselves be compromised.
- Emailing them to yourself is the worst of all. Your email is the account most likely to be targeted, and now it contains the recovery keys to everything else.
- A browser notepad — including ours — is for scratch text, not credentials. Local storage is not encrypted.
Setting them up properly: a checklist
- Generate them at setup. When you enable 2FA, take the codes then. Do not skip the screen.
- Store them in two places using two different methods — for example paper in a safe plus an encrypted note.
- Label each set clearly with the service name and the date. Unlabeled codes are useless a year later.
- Cross off codes as you spend them so you know how many remain.
- Regenerate when you drop to two or three left. Generating a new set invalidates the old one immediately, so replace your stored copies at the same time.
- Regenerate after any suspected exposure — a lost wallet, a shared computer, a device you sold.
Where to find your backup codes
The wording varies by platform, but they are almost always under account security settings, labelled “backup codes,” “recovery codes,” or “one-time codes.” Google, GitHub, Facebook, Binance, Dropbox, and most major services all provide them. For exchange-specific steps, see our walkthrough on setting up 2FA on Binance.
If a service offers no backup codes at all, that is a meaningful signal about its recovery process. Find out what its account recovery looks like before you need it.
Frequently asked questions
Can I reuse a backup code?
No. Each code is invalidated permanently the moment it is used. This is intentional — it means an intercepted code that has already been spent is worthless to an attacker.
What if I run out of backup codes?
Log in using your authenticator, go to your account’s security settings, and generate a fresh set. Doing so invalidates all previous codes immediately, so update your stored copies at the same time.
Do backup codes expire?
Generally no. They stay valid indefinitely until you use them or generate a new set. A few services expire them after a long period, so it is worth verifying yours still work occasionally.
Is it safe to keep backup codes in a password manager?
Yes, for most accounts, because the codes are encrypted at rest. The exception is the password manager’s own backup codes — keep those on paper, or you risk being locked out of the vault that holds everything else.
Are backup codes the same as my 2FA secret key?
No. Your secret key is the seed that generates every future TOTP code, so anyone holding it can produce valid codes forever. Backup codes are randomly generated, work once each, and are stored on the service’s servers rather than derived from your key.
What if I lost both my phone and my backup codes?
You are down to the service’s identity-verification process, which varies enormously — some platforms restore access in days, others cannot help at all. Start with the provider’s account recovery form and expect it to take time. Avoiding a repeat starts with backing up your authenticator app properly.
Related reading
- What is two-factor authentication? — how the second factor works and why SMS is the weakest option.
- Best Google Authenticator alternatives — apps compared on backup and recovery features.
- Free 2FA code generator — generate TOTP codes in your browser when you need them.
For the formal guidance on recovery mechanisms, NIST SP 800-63B sets out how authenticator binding and account recovery should be handled, and the CISA guidance on multi-factor authentication is a readable overview for non-specialists.
5 Responses