# Recovery codes

> Single-use codes that get you in when your phone does not. Where to keep them, and what to do when they run out.

Source: https://www.revquix.com/docs/account/recovery-codes
Last verified: 2026-09-03

---

When you turn on [two-step verification](https://www.revquix.com/docs/account/two-step-verification)
you are given a set of recovery codes. They are your way in when your authenticator is not available -
a lost phone, a wiped device, an app that did not survive a migration.

## Save them properly

They are shown once, at enrolment, and offered as a download.

> **Warning** - A screenshot on the phone running your authenticator is not a backup
>
> It is the single most common mistake here, and it fails in exactly the case recovery codes exist for:
> you have lost that phone. Put them where they survive losing the device - a password manager, a
> printout, a file on another machine.

## Using one

At the code prompt, enter a recovery code instead of the six digits. **Each works once** and is spent
immediately.

> **Note** - A recovery code is checked before an authenticator code
>
> Deliberately. Somebody reaching for a recovery code is usually in the situation where the app is
> unavailable, and making them wait on a check that cannot succeed helps nobody.

After using one, re-enrol your authenticator on your new device as soon as you can. You are down to a
finite set of codes until you do.

## Regenerating

You can generate a fresh set at any time.

> **Warning** - Regenerating invalidates every previous code immediately
>
> The old list stops working the moment the new one is issued. If you have those codes written down
> somewhere, replace them - a stale printout is worse than none, because you will reach for it.

Regenerate when you have used several, when you cannot account for where an old copy is, or after
anything that felt like a security scare.

## If you have lost both

Your phone and your codes together means you cannot get in on your own. Contact support - expect to
prove who you are, and expect it to take time. That friction is deliberate: an account-recovery route
easy enough to be convenient is a route an attacker can use.

- [Two-step verification](https://www.revquix.com/docs/account/two-step-verification) - Enrolling and re-enrolling.

- [Help and support](https://www.revquix.com/dashboard/help) - If you are locked out.