Backup Codes: The Safety Net Most People Skip
Backup codes let you into your account if you lose your phone or authenticator. What they are, where to store them safely, how to use them, and when to generate new ones.
When you turn on two-step verification, many services show you a list of backup codes and suggest you save them. Most people click past. Then their phone is lost, stolen, broken or replaced, and they cannot get into their own email. Backup codes are the simple safety net that prevents that.
What backup codes are
- A short list of one-time codes, usually 8 to 10.
- Each code works once, in place of your normal second step.
- They are tied to that one account.
- You can usually generate a new set at any time, which cancels the old set.
Where to store them
| Good places | Bad places |
|---|---|
| Your password manager, in the notes for that account | A photo in your camera roll |
| Printed and kept with important documents at home | An email to yourself |
| A second trusted location, such as a locked drawer | A text file on your desktop called "codes" |
Do not keep your only copy of backup codes behind the same phone you might lose. Keep at least one copy somewhere else, such as on paper at home.
Which accounts need them most
- Your main email account.
- Your password manager.
- Your phone's cloud or app store account.
- Social media accounts that matter to you or your business.
How to use a backup code
- Sign in with your password on the official site or app.
- When asked for your second step, choose "try another way" or "use a backup code".
- Enter one unused code.
- Cross it off or delete it from your list.
- Once in, fix the problem: set up your authenticator or passkey again on your new device.
When to generate new codes
- When you have used most of them.
- If you think someone has seen them.
- After recovering from an account takeover.
Never give backup codes to anyone. Support staff, banks and "recovery services" do not need them. Anyone asking is trying to take over your account.
Got a message asking for a recovery code? Paste it into CyberWatch AI Scan for a free check.
Backup codes pair with authenticator apps and passkeys. For more, read our guide on how to protect your accounts.
Frequently asked questions
What are backup codes?
One-time codes a service gives you when you set up two-step verification. Each one can be used once to sign in if your usual second step is unavailable.
Where should I keep backup codes?
In your password manager, or printed and kept somewhere safe at home. Not as a photo in your phone's camera roll, and not in your email.
Can I share backup codes with support staff?
No. Genuine support staff do not ask for backup codes. Anyone asking for them is trying to get into your account.
Sources
- Sign in with backup codes, Google Account Help
- Use Two-Factor Authentication To Protect Your Accounts, US Federal Trade Commission
- Recovering a hacked account, UK National Cyber Security Centre
