Short answer: They are three different things that services confusingly name in overlapping ways. Backup codes are a list of single-use codes that substitute for your 2FA code. A recovery key is usually one long string that unlocks or restores an account, often replacing normal support recovery entirely. A recovery code can mean either, depending on the service. What matters is not the label but the answer to one question: is this thing single-use or permanent, and what happens if I lose it?
Backup codes: the common case
What Google, GitHub, Facebook, Dropbox and most others give you when you enable 2FA. Typically eight or ten codes, each valid once, used in place of an authenticator code.
- Single use. Once used, that code is dead.
- Regenerable. You can create a new set at any time, which invalidates the old one — and this is the step people forget after using one.
- Same power as a code, not more. They get you past 2FA; you still need your password.
Full detail on handling them: where to store 2FA backup codes safely.
Recovery keys: the serious one
A single long string — Apple’s is 28 characters, Microsoft’s 25 — that restores access when everything else is gone.
The crucial difference is what it replaces. On Apple, creating a recovery key disables standard account recovery. That is deliberate: it removes the possibility of someone social-engineering Apple support into resetting your account. It also means losing the key and your devices leaves you with no route back, permanently. See our Apple Account guide.
Similar concepts appear elsewhere with different weight:
- Microsoft recovery code — a 25-character string, one per account, regenerable — Microsoft guide.
- Password manager emergency kit / secret key — needed alongside your master password to set up a new device. Not a password reset; without it, the vault stays locked.
- Steam’s R-code — detaches the mobile authenticator — Steam Guard guide.
- Blizzard’s restore code — same idea for the Battle.net authenticator.
Where the vocabulary breaks down
Services use these terms inconsistently, and it genuinely confuses people:
- GitHub says “recovery codes” for what are functionally backup codes.
- X issues a single “backup code” that is regenerable — more key-like than list-like.
- LinkedIn shows one “recovery code” at setup.
- Snapchat and Roblox say “recovery code” for something you generate once.
- Instagram says “backup codes” for a list of eight.
So do not rely on the name. When a service gives you something, ask three questions:
- How many uses does it have? Single-use or repeatable.
- Can I regenerate it? If yes, losing it is recoverable. If no, it is precious.
- What does it replace? Just the 2FA step, or the entire support recovery process?
That third answer determines how carefully you store it. Something that only replaces a six-digit code is less dangerous to lose than something that is your only route back into an account.
The seed phrase is a different animal
Worth separating clearly, because people group it with the above and it does not belong.
A crypto wallet seed phrase is not a recovery mechanism for an account — it is the wallet. Anyone holding it owns the funds, permanently, with no revocation, no support desk and no reset. There is no equivalent among the codes discussed here.
Treat it accordingly: never digital, never typed anywhere except your wallet’s recovery screen, ideally stamped in metal. See 2FA for crypto.
How to store each
Backup codes — a password manager entry is fine for most accounts, plus a printed copy for your critical few. Never in the account they unlock, and never in a camera roll.
Recovery keys — printed, physical, somewhere you keep passports and certificates. Two copies in two locations if the account matters. A password manager works only if you can reach that manager without the account the key protects — check for circular dependencies.
Everything — write down which account each belongs to. A drawer of unlabelled strings is not a recovery plan, and this is a surprisingly common state of affairs.
The wider approach is in how to back up your authenticator app.
The circular dependency trap
The most common mistake, and worth checking today:
- Google backup codes saved in Google Drive.
- Dropbox recovery codes in Dropbox.
- Password manager emergency kit in the vault it unlocks.
- Apple recovery key in iCloud Notes.
Each works perfectly until the exact moment you need it. If your storage requires the account you are trying to recover, it is not a backup.
Frequently asked questions
Do backup codes expire?
Not usually by time. They become invalid when used, or when you regenerate the set. If you have not looked at yours in years, check they still match what the service has.
Should I regenerate after using one?
Not required, but sensible if you are down to your last few. Remember to replace your stored copy, since regenerating kills the old set entirely.
What if I lose my recovery key?
Depends on the service. Microsoft lets you generate a new one while signed in. Apple’s, if lost along with your devices, can mean permanent loss — which is why you should only create one if you will store it properly.
Is a recovery key the same as a password?
No. A password is for routine sign-in; a recovery key is for emergencies and often bypasses other verification. Its power is why it deserves physical storage.
Can I use one backup code twice?
No — single use by design. That is what makes a stolen code much less useful than a stolen password.
What if a service gives me none of these?
Some do not — Amazon, TikTok, cPanel among them. Then your recovery route is the registered email and phone, so those need to be current and well protected. Enrolling a second device at setup matters even more.
The bottom line
Ignore the names and ask what the thing does: single-use or permanent, regenerable or not, and does it replace support recovery. Store the powerful ones physically, keep the routine ones in a password manager, label everything, and check nothing is stored inside the account it is meant to rescue.
Doing an audit? Pair this with the 9 most common 2FA mistakes.