Frequently asked questions

Recovery codes (backup codes) are one-time-use codes a service gives you when you enable two-factor authentication. If you lose your phone or authenticator app, you can enter one of these codes instead of the usual 2FA code to regain access. Each code works exactly once. Full explanation.

No. ReKey generates random strings for testing, documentation and demos. They are not tied to any account, and any login form will reject them. Only the recovery codes issued by the service itself — shown in its 2FA settings — can recover an account there.

Yes. The generator runs entirely in your browser using crypto.getRandomValues(). Nothing is sent over the network, no cookies are set, nothing is stored or tracked. See the privacy policy.

Most services issue 8 to 10 backup codes per set, though the exact number varies by provider. That is why 10 is the default in the ReKey generator (adjustable from 1 to 50).

The code is burned — it can never be used again, by you or anyone else. You are logged in and can repair your 2FA setup (remove the lost device, enroll a new one), after which you should generate a fresh set of codes.

Single-use invalidation means a leaked, photographed or shoulder-surfed code cannot be reused later. The service marks each code as spent the moment it is accepted — that is what makes the set safe to keep on paper.

Print them and keep the paper somewhere physically secure (locked drawer, safe), or save them in a reputable password manager's secure notes — always separate from the device you use for 2FA. Never store them as phone screenshots, unencrypted notes, or emails to yourself. Full storage guide.

Lengths of 8, 10, 12 or 16 characters; numeric, uppercase alphanumeric or mixed-case character sets; and grouped (XXXX-XXXX) or continuous output — matching the styles real services use. Format guide.

Testing 2FA login flows in staging environments, documentation and tutorials about backup codes, UI mockups and screenshots where real credentials must never appear, and QA seed data. All legitimate use cases.

No. ReKey has no connection to any service and cannot issue working recovery codes. Use that service's own account-recovery process (usually linked from its login page), and check whether you saved its backup codes when you enabled 2FA.