Guide · 2FA backup codes
When you turn on two-factor authentication (2FA) for an account, most services hand you a small list of recovery codes — also called backup codes. They are your emergency spare keys: if you lose your phone, your authenticator app stops working, or you get a new device before transferring your 2FA setup, you can type in one of these codes instead of the usual 6-digit verification code and get back into your account.
How recovery codes work
The mechanics are deliberately simple. During 2FA setup, the service generates a set of random codes — typically 8 to 10, though the exact count varies by provider — and shows them to you exactly once. The service stores a record of those codes (properly, only a cryptographic hash of each one), and you are expected to save the list somewhere safe.
Later, at the login screen, there is usually a "try another way" or "use a recovery code" option. You enter your username and password as normal, then instead of the authenticator code, you type one unused recovery code. The service checks it, marks it as spent, and lets you in. From there you can usually disable the old 2FA method, enroll a new device, and generate a fresh set of codes.
Why each code works only once
This is the single most important thing to understand about backup codes: each code is single-use. The moment you spend one, it becomes invalid forever. The service invalidates it precisely so that a leaked or photographed code cannot be reused later by someone else.
The practical consequence: after you use even one code from your set, you should review your 2FA settings and generate a new set. Most providers let you regenerate codes at any time, which replaces the entire old set. If you keep limping along on a half-spent list, you are one lost phone away from having no spares left.
Recovery codes vs. authenticator codes
People often confuse the two, so here is the distinction:
- Authenticator codes (TOTP) are 6-digit codes that change every 30 seconds. They are generated on the fly by an app like Google Authenticator or Authy from a shared secret. They are your everyday second factor.
- Recovery codes are fixed, long, random strings that never change until you regenerate them. They are your emergency fallback, meant to be used rarely — ideally never.
Recovery codes are not a replacement for your authenticator. Think of TOTP as the key you use daily and recovery codes as the spare set you keep in a drawer for the day the daily key breaks.
When do you receive them?
Services show recovery codes once, at the moment you enable 2FA (or when you explicitly regenerate them). This is by design: if the codes could be viewed again later without strong re-verification, anyone who briefly accessed your logged-in session could copy them. That is why providers urge you to save or print the list immediately — if you close the window without saving, you may need to re-verify your identity to generate a new set.
Not every service offers them. Some rely instead on backup email addresses, phone numbers, hardware security keys, or account-recovery processes. The length, character set and quantity of codes also vary from service to service — there is no single standard format.
What happens after you use one?
Three things, in order:
- The code is burned — it can never be used again, by you or anyone else.
- You are logged in and can repair your 2FA setup: remove the lost device, enroll the new one.
- You should generate a fresh set of recovery codes and store the new list, since the old one is now partially spent.
Some services also notify you by email when a recovery code is used, which is a useful tripwire: if you did not use one yourself, that notification means someone else did.
Important: the codes from the ReKey generator are random strings for practice, testing and documentation. They are not issued by any service and cannot recover any account. Real recovery codes only ever come from the service's own 2FA settings page.
Key takeaways
- Recovery codes are one-time-use emergency codes issued when you enable 2FA.
- They let you bypass a lost or broken second factor — which is exactly why they must be stored securely.
- They do not replace your authenticator; they are the fallback for when it is unavailable.
- After using one, regenerate the set so you are never caught with zero spares.
Next: store them properly
Knowing what backup codes are is step one. Step two is keeping them somewhere they will actually be available in an emergency.
How to store backup codes