What Are Backup Codes, and Why Not to Screenshot Them to Your Camera Roll
At some point you've set up two-factor authentication on an account, and near the end of the process a screen appeared showing ten short codes with a "download" or "print" button underneath, and a warning to store them somewhere safe. Almost everyone clicks past this screen without really reading it. Then, months later, a phone gets dropped in a lake, or stolen, or simply won't turn on, and suddenly those ten forgotten codes are the only thing standing between you and being locked out of your own account.
Backup codes, also called recovery codes, are a batch of one-time-use passwords generated when you set up two-factor authentication. Unlike an OTP, they don't expire and stay valid until used. They exist as a fallback for when your phone or authenticator app is unavailable, and should be stored in a password manager or a physical safe, never as a screenshot on the same phone they're meant to rescue you from.
What is a backup code, exactly?
A backup code, sometimes called a recovery code, is a static, single-use password generated at the same time you set up two-factor authentication. Unlike an OTP from an authenticator app, a backup code doesn't expire after thirty seconds and doesn't depend on your phone's clock or a shared secret being recalculated on the fly. It's just a long random string, sitting on a server, waiting. You typically get eight to ten of them in one batch, and each one works exactly once. Use it, and it's permanently burned, whether or not it actually succeeded in logging you in.
The reason services hand you a batch instead of a single code comes down to how account recovery is meant to work. A single backup code would itself become a single point of failure. A batch of ten means you can recover your account several times over years, across several "I lost my phone" incidents, without needing to regenerate them constantly.
Why do backup codes exist at all?
Two-factor authentication is supposed to require something you know (a password) and something you have (a phone, an authenticator app, a hardware key). That's a great security model right up until the "something you have" part is unavailable, lost, stolen, factory reset, or simply a different phone because you upgraded and forgot to migrate your authenticator app. Without a fallback, a lost phone would mean a permanently locked account. Backup codes are the escape hatch: a form of "something you have" that lives on paper or in a password manager rather than on the device that might fail you.
Why shouldn't I just screenshot them?
The single most common mistake is screenshotting the codes and leaving that screenshot sitting in a phone's camera roll, which is precisely the device most likely to be the thing that gets lost or stolen in the scenario the codes exist for. If your phone is what fails, a screenshot on that same phone fails with it.
A close second: emailing the codes to yourself for "safekeeping", which usually means they now live forever in an inbox that's protected by, ironically, the same account security you were trying to strengthen in the first place. If an attacker gets into your email, they now have both your recovery codes and a way to intercept password reset links.
The actual right places to store them are boring: a password manager's secure notes feature, a printed copy kept somewhere physically secure like a safe or a locked drawer, or, for the security-conscious, both. The point is redundancy that doesn't share a single point of failure with the device the codes are meant to rescue you from.
What happens after I use one?
Once a backup code is used, it's gone, permanently, regardless of whether the login attempt succeeded. This trips people up occasionally: type a code in wrong, and that attempt, and sometimes the code itself depending on the service, is consumed anyway. Most services will let you regenerate a fresh batch of ten once you're logged back in, which immediately invalidates the old batch. It's good practice to do this any time you've had to dip into your codes, rather than slowly working your way through the original ten over several years.
If you ever burn through all ten without regenerating, most services fall back to a manual identity verification process, which is slower, sometimes involves customer support and photo ID, and is exactly the situation backup codes exist to help you avoid.
Generating sample codes for your own systems
If you're building an application that needs its own recovery code flow and want to see what a properly formatted batch looks like, or need sample codes for documentation, QA or a demo environment, the recovery code generator on this site produces batches in the standard style, entirely client-side, with nothing sent to a server. It won't wire itself into an actual authentication system for you, but for prototyping the format and the UX around it, it saves you writing the pattern from scratch.
Frequently Asked Questions
How many backup codes do I usually get?
Most services generate a batch of eight to ten single-use codes at once, when you first set up two-factor authentication. Each one works exactly once and is permanently invalidated after use.
Are backup codes the same as an OTP from an authenticator app?
No. A backup code is static and doesn't expire after thirty seconds like an OTP does. It sits on the server waiting to be used, whereas an OTP is recalculated fresh every time from a shared secret and the current time.
Is it safe to screenshot my backup codes?
It's the single most common mistake people make with them. A screenshot usually ends up in the camera roll of the same phone that's most likely to be lost or stolen, which is exactly the scenario backup codes exist to protect against.
Where should I actually store backup codes?
A password manager's secure notes feature, or a printed copy kept somewhere physically secure like a safe or locked drawer. Avoid emailing them to yourself, since your inbox is often protected by the same account security you were trying to strengthen.
What happens after I use a backup code?
It's permanently consumed, whether or not the login attempt actually succeeded. Once you're logged back in, most services let you regenerate a fresh batch of ten, which immediately invalidates whatever was left of the old batch.
What if I lose or use up all my backup codes?
Most services fall back to a manual identity verification process at that point, which is slower and sometimes involves customer support and photo ID. This is exactly the situation backup codes are meant to help you avoid, so it's worth regenerating a fresh batch as soon as you dip into your existing one.