Recovery codes for testing, docs and demos
Generate realistic 2FA-style backup recovery codes instantly. Pick the count, length, character set and grouping, then copy or download the set. Everything runs 100% in your browser — no sign-up, no server, nothing stored.
Most services issue 8–10 backup codes per set.
8–10 characters matches the most common real-world backup code style.
Alphanumeric uppercase is the classic backup-code look.
Groups of four with dashes are easier to read and type.
Your codes will appear here. Click any code to copy it individually.
Honest limits — read before you use these
- These are random strings for practice, testing and documentation only. They are not tied to any account, service or identity.
- They are NOT real account recovery codes. Real services (Google, GitHub, Apple and others) generate their own backup codes when you enable two-factor authentication — only those codes can recover an account.
- Never use these as actual account recovery codes. Entering them into any login form will not work, and treating them as security material creates a false sense of protection.
- Safe uses: building and testing 2FA user interfaces, writing documentation or tutorials, creating realistic demo data and screenshots.
How the generator works
No accounts, no network calls, no fine print. The whole tool is a small JavaScript file that runs on your device.
Cryptographically secure randomness
Each character is drawn with crypto.getRandomValues(), the browser's built-in secure random number generator — the same API security-sensitive web apps rely on. Rejection sampling avoids modulo bias, so every character is equally likely.
Nothing leaves your device
Generation, copying and the .txt download all happen locally in your browser tab. There is no backend, no database and no analytics watching what you generate. Close the tab and the codes are gone — we never see them.
Formatted like real backup codes
Choose 8, 10, 12 or 16 characters in numeric, uppercase alphanumeric or mixed-case sets, with readable XXXX-XXXX grouping or a continuous string — matching the styles real services use for 2FA backup codes.
When to use these codes
This tool exists for one honest job: producing realistic-looking recovery codes that carry no security weight. Here is where that is genuinely useful — and where it is not.
Testing 2FA flows
Building a login screen with a "use a backup code" option? Generate a set and walk through your UI — entering, validating, marking codes as used — with data that looks like the real thing.
Documentation and tutorials
Writing a guide about two-factor authentication or backup codes? Drop in a generated set instead of typing fake codes by hand, and screenshot the result.
Real account recovery
These codes cannot unlock any account. Only the backup codes issued by the service itself — shown when you enable 2FA — work for that service. Never substitute generated strings for real ones.
New to backup codes?
Learn what 2FA recovery codes actually are, how they differ from authenticator codes, and how to store the real ones safely.
Read the guideQuick answers
What are 2FA recovery codes? +
Recovery codes (also called backup codes) are one-time-use codes a service gives you when you enable two-factor authentication. If you lose your phone or authenticator app, you can enter one of these codes instead of the usual 6-digit 2FA code to get back into your account. Each code works exactly once.
Can I use codes from this generator on a real account? +
No. Recovery codes are created and stored by the service itself; only the codes it issued can authenticate you there. Codes from this tool are random strings with no link to any account — they will simply be rejected by any login form.
Is the generator really private? +
Yes. The generator is plain JavaScript running in your browser. It uses crypto.getRandomValues() for randomness, sends nothing over the network, sets no cookies and stores nothing. See our privacy page for the full details.
How many backup codes do real services give you? +
Most services issue a set of 8 to 10 codes — Google shows 10, GitHub shows 16, and the exact count varies by provider. That is why 10 is the default here.
What format do real backup codes use? +
It varies: some services use 8-digit numeric codes, others use 8–10 character alphanumeric strings, often grouped with dashes (like XXXX-XXXX) for readability. Our formats guide breaks down the common styles and the math behind them.
How should I store real backup codes? +
Print them and keep the paper somewhere safe, or save them in a reputable password manager's secure notes — and keep that storage separate from the device you use for 2FA. Never screenshot them into your photo gallery or email them to yourself. Full guidance: how to store backup codes.
Recovery code guides
Short, practical explainers on backup codes: what they are, how to store them, which formats exist, and what they are good for.
What are recovery codes?
How 2FA backup codes work, why each one is single-use, and what happens when you spend one.
Read guide → GuideHow to store backup codes
Password managers, printed copies, encrypted drives — and the convenient places you should avoid.
Read guide → GuideRecovery code formats
Numeric vs alphanumeric, grouping, lengths, and how much entropy each style actually carries.
Read guide →