When you switch on two-factor authentication, a service usually hands you a list of recovery codes — and most people click past them without a second thought. Those codes are your lifeline if you ever lose your phone, and ignoring them is how people get permanently locked out of their own accounts. Our GetMyPassword team explains what recovery codes are, how to use them, and where to keep them safe.
What recovery codes are
Recovery codes — also called backup codes — are a set of one-time passwords a service gives you when you enable two-factor authentication. Each works once. Their job is simple: if you cannot get your normal 2FA code — phone lost, app reset, no signal — you enter a recovery code instead and still get in.
Why they matter so much
Two-factor authentication is powerful precisely because no one can log in without that second factor — including you, if you lose it. Recovery codes are the safety net. Without them, losing your phone can mean a long, sometimes impossible, account-recovery process. With them, it is a thirty-second fix.
Where to keep them safe
- Print them and store the paper somewhere secure, like a home safe.
- Save them in your password manager, alongside the account but separate from the device that generates your codes.
- Do not store them in a plain note on the same phone that holds your authenticator — if that phone is lost, so are both.
Recovery codes only help if they are somewhere other than the device you might lose. A backup code saved only on the phone with your authenticator app protects you against nothing.
Generate new ones if in doubt
If you think your recovery codes were seen or lost, most services let you regenerate a fresh set under Security settings, which instantly invalidates the old ones. Treat them like passwords: keep them private, store them safely, and pair them with a strong unique password from our password generator. Together they make sure two-factor authentication protects you without ever locking you out.
Frequently asked questions
What do I do if I lose my recovery codes?
If you can still log in, go to the account’s Security settings and regenerate a new set, which cancels the old ones. If you are locked out entirely, you will need the service’s account-recovery process, which can be slow.
Can I reuse a recovery code?
No. Each recovery code works only once, then it is used up. That is why services give you several at a time — keep track of how many you have left and regenerate them when they run low.
Where is the safest place to store recovery codes?
Somewhere other than the device that generates your 2FA codes — printed in a safe place, or in a password manager. The key rule is that losing your phone should not also lose your backup codes.