Recovery codes
Single-use codes that get you in when your phone does not. Where to keep them, and what to do when they run out.
When you turn on two-step verification you are given a set of recovery codes. They are your way in when your authenticator is not available - a lost phone, a wiped device, an app that did not survive a migration.
Save them properly#
They are shown once, at enrolment, and offered as a download.
Using one#
At the code prompt, enter a recovery code instead of the six digits. Each works once and is spent immediately.
After using one, re-enrol your authenticator on your new device as soon as you can. You are down to a finite set of codes until you do.
Regenerating#
You can generate a fresh set at any time.
Regenerate when you have used several, when you cannot account for where an old copy is, or after anything that felt like a security scare.
If you have lost both#
Your phone and your codes together means you cannot get in on your own. Contact support - expect to prove who you are, and expect it to take time. That friction is deliberate: an account-recovery route easy enough to be convenient is a route an attacker can use.
Was this page helpful?