First: do not panic, check these places
Most "lost" recovery codes are misplaced, not destroyed. Before anything drastic, search systematically:
- Your password manager — most people save codes in the secure notes of 1Password, Bitwarden or Apple's Keychain and forget. Search for the service name.
- Downloads and documents folders — codes are often saved as
.txtfiles or PDFs with names like "backup codes" or the service name. - Printed copies — check the desk drawer, the safe, the folder where you keep "important papers." People who print codes usually file them sensibly.
- Old devices and backups — a screenshot on a previous phone, a cloud photo backup, an old laptop's downloads folder.
- Email — search for the service name plus "recovery" or "backup codes." Some services email the codes at setup.
Found them? Skip to the prevention section at the end and store them properly this time. Still missing? Work down the list below. And if the problem is not the codes themselves but a forgotten master password to the vault holding them, these password hint memory techniques can help jog it.
Option 1: Use another logged-in session
The fastest recovery is the session you forgot about. Check every device: the phone app you never log out of, the tablet, the work laptop, the browser with the remembered session. If you can get into the account anywhere, go straight to the security settings and generate a fresh set of backup codes — this usually invalidates the old ones, which is fine since they are lost anyway. Save the new set properly before you log out of anything.
Option 2: Use an alternate 2FA method
Many accounts have more than one second factor enrolled: SMS codes, an authenticator app, a hardware security key, or passkeys. If any alternate method still works, use it to sign in, then regenerate backup codes from security settings. This is also the moment to enroll a second method while you are in — redundancy is the lesson of this whole experience.
Option 3: Account recovery and support
If no session and no alternate factor work, you are in the service's account recovery flow. What to expect:
- Identity verification: government ID, a selfie, answers to security questions, or confirmation from a recovery email or phone number. Have these ready before you start.
- Waiting periods: many services impose a delay of several days before restoring access — a deliberate anti-takeover measure. There is no way to skip it; plan around it.
- Data loss risk: some services (notably encrypted ones) cannot restore access at all without the codes — the encryption means even the company cannot help. Know which of your accounts fall in this category before you need recovery.
Start the process immediately rather than "trying one more thing" for a week. Recovery queues and waiting periods mean every day of delay is a day added to the lockout.
Option 4: The nuclear options
When recovery fails or is impossible: create a new account and migrate what you can (contacts, data exports, subscriptions), and treat the locked account as lost. For financial or tax accounts, contact the institution directly — they have offline identity verification processes that consumer tech support lacks. Document everything; if the account held money or legal records, persistence with support pays.
What NOT to do
- Do not buy "account recovery" services from third parties. They are scams or, at best, people filling out the same free recovery form you can fill out yourself — while holding your ID documents.
- Do not disable 2FA out of frustration once you are back in. The lockout is evidence the protection works; the fix is better backups, not weaker security.
- Do not reuse the "found" old codes after generating new ones — regeneration invalidates the old set, and trying them just burns attempts.
The retired-means-retired rule generalizes beyond recovery codes: product identifiers follow the same discipline — a number that is retired stays retired, as this guide to serial number best practices explains.
Preventing the next lockout
| Habit | How |
|---|---|
| Store codes in a password manager | Secure note, labeled with the service name and date generated |
| Keep one offline copy | Printed, in a safe or locked drawer — survives dead phones |
| Enroll two factors | Authenticator app plus security key or SMS fallback |
| Regenerate yearly | Fresh codes, fresh storage check — calendar it |
| Test recovery annually | Sign in on a private window using a backup code to prove the system works |
For developers and testers who need realistic codes to build against, our recovery code generator produces sample codes in common formats — never use generated codes as real account security.
Frequently asked questions
Can support just give me new recovery codes?
Almost never directly — that would defeat the purpose of the codes. Support can verify your identity and help you regain access, after which you generate new codes from inside the account.
How long does account recovery take?
Anywhere from minutes (automated ID verification) to weeks (manual review plus security waiting periods). Start immediately; the clock starts when you file, not when you feel ready.
Are my backup codes really single-use?
On most services, yes — each code works once, then burns. That is why a set of ten codes is ten emergency logins, not a reusable password. See our guide on what recovery codes are for the full mechanics.
What if I lose my phone AND my codes?
That is exactly the scenario backup codes exist for — which is why they must live somewhere other than the phone. Password manager plus a printed copy covers it.
Should I store recovery codes in the cloud?
An encrypted password manager that syncs is fine and is the best balance for most people. Unencrypted notes apps, email drafts and screenshots in your photo roll are not.