2FA Backup Codes: What They Are and How to Store Them Safely

What Backup Codes Actually Are

A backup code is not a second password and it is not a TOTP code. It is a single-use, pre-generated credential that a service hands you the moment you turn on two-factor authentication, specifically so that a lost phone, a broken authenticator app, or a factory-reset device does not permanently lock you out of your own account.

The distinction matters. A TOTP code from an app like 2FAFast's generator is time-based, it changes every 30 seconds and is derived from a shared secret. A backup code is static. It sits in a list, unused, until the day you need it, and then it is burned forever the moment it is entered. Think of it less as a second factor and more as an escape hatch built into the 2FA system itself.

Anatomy of a Backup Code Set

Every service formats its codes slightly differently, but the underlying idea is identical: a batch of 8 to 16 random strings, usually digits or a mix of digits and letters, generated once and shown to you exactly one time.

Google style (10 codes, 8 digits each):
83749201
72948301
61837492
...

GitHub style (16 codes, hyphenated hex):
a8f3-9e2b
c7d1-4f5a
...

Dropbox style (grouped digits):
73928 18374 29384
...

Microsoft style (10 codes, 8 characters, alphanumeric):
h3k9m2p7
...

Whatever the format, the rule is the same across every platform: enter one in place of your regular 2FA code when prompted, and the account lets you in. That code is then permanently retired and cannot be reused, even by you.

Platform-by-Platform: How Many Codes You Actually Get

The number of codes issued varies more than most people expect, and it affects how often you need to think about regenerating your set. Here is what the major platforms provide as of this writing:

Notice how differently Apple and Coinbase treat this compared to Google or GitHub. Some services fold the "backup code" concept into a single long recovery key instead of a list, because the account holds higher-value assets and they want one credential that is harder to lose track of, rather than ten smaller ones scattered across a note. If you rely heavily on a service that uses this single-key model, treat that one string with the same care you would a master password.

Why the Codes Are Cryptographically Random, and Why That Matters

Backup codes are not sequential, they are not derived from your username, and they are not predictable from any pattern in your account history. They are generated using a cryptographically secure random number generator on the server side, the same class of randomness used to create session tokens and encryption keys.

In practical terms, an 8-digit numeric code has around 26.5 bits of entropy, and an 8-character alphanumeric code has closer to 40 to 48 bits, depending on the character set. That means guessing a single valid code by brute force is not a realistic attack. A ten-code set does not meaningfully weaken this, because each attempt against a live login form is rate-limited, logged, and typically locked out after a handful of failures.

What this means for you day to day: the risk with backup codes has never been that someone will guess one. The risk is entirely about exposure, someone finding your list because you stored it somewhere they could read it. The math protects you from brute force. Your storage choices protect you from everything else.

A Real Login Walkthrough: Using a Backup Code

Here is exactly what the flow looks like in practice, using a typical account recovery scenario, say you dropped your phone in a lake the night before a work trip and need into your email from a borrowed laptop.

1. Go to the normal login page and enter your email address and password as usual.
2. The site prompts for your second factor, normally where you would open your authenticator app and type the 6-digit code.
3. Look for a small link near the code entry box, usually worded "Try another way," "Use a backup code," "Enter a recovery code," or "Lost your phone?"
4. Click through to the backup code entry screen. Some services ask you to confirm your identity again first with a re-entered password.
5. Pull up your stored list (from your password manager, your printed sheet, or wherever you saved it) and type in one unused code exactly as written, including any dashes or spaces the format requires.
6. The system verifies the code, marks it as used, and logs you in for that session.
7. Before you do anything else, go straight to Security settings. Remove the old device if it is still listed, add your new device or reinstalled authenticator app, and generate a brand new set of backup codes.
8. Throw away or securely delete the old list. Even though the codes on it are mostly unused, regenerating retires every remaining one, so there is no reason to keep two lists floating around.

The entire process usually takes under two minutes once you locate the code. The part that trips people up is step 5, not having the list accessible when they need it. That is the actual failure mode worth planning for, not the mechanics of the login screen.

What Not to Do, With Specifics

• Do not screenshot the code list on your phone. Photos apps sync to iCloud Photos or Google Photos by default on most devices, meaning a plaintext image of your emergency access codes is now sitting in a cloud account, searchable by "screenshot" or by date, and reachable from any device signed into that same account.
• Do not paste them into a sticky-note app or a generic notes app without encryption. Apps like the stock Notes or Keep sync in plaintext across devices by default. If that account is ever compromised, so are your codes.
• Do not email the list to yourself "just to have a copy." Email accounts are themselves frequent phishing and credential-stuffing targets. Codes sitting unencrypted in a sent-mail folder defeat the purpose of having a recovery mechanism separate from your primary email.
• Do not store the codes in the same authenticator app that generates your TOTP codes. If that app or its backup is lost, damaged, or the account tied to it is deleted, you lose both your regular 2FA and your emergency fallback in a single event.
• Do not rely on browser autofill or a browser-saved note. Browser profiles sync across devices too, and a stolen or compromised browser sync account exposes the same problem as a photo library or notes app.

For a full breakdown of where to actually store your codes long term, including password manager setups, physical storage, and encrypted file options, see our companion guide, How to Store Backup Codes Safely. That article covers storage mechanics in depth; this one is about what the codes are and how the count and format differ by platform.

Keeping Your Set Healthy

Backup codes are not a set-and-forget item. A few triggers should prompt you to regenerate:

• You have used more than half the set. Do not wait until you are down to your last code before generating a fresh batch.
• You changed devices or reinstalled your authenticator app. New device, new backup set, every time.
• You suspect your storage location, whether a note, a password manager entry, or a printed page, may have been seen by someone else.
• It has simply been a long time and you cannot remember where you last saved them. If you cannot locate the list confidently, it is not doing its job.

Frequently Asked Questions

How many backup codes should I expect when I enable 2FA?

Most consumer services issue between 8 and 16 codes in one batch. A few, like Coinbase, use a single longer recovery string instead of a list. Check the specific service, since the count and format are not standardized across the industry.

Do backup codes work the same way as a TOTP code from an authenticator app?

No. A TOTP code is time-based and regenerated every 30 seconds from a shared secret, while a backup code is static, pre-generated, and single-use. You can read more about how TOTP codes are generated using our free 2FA code generator, which produces the same style of codes your authenticator app does.

What happens the moment I use a backup code to log in?

That specific code is permanently invalidated on the server side the instant it is accepted. It cannot be reused by you or by anyone else who might have seen it, which is exactly why the codes are safe to write down in more than one place.

Should I regenerate my backup codes after every login recovery?

Yes. The moment you use a backup code to recover access, treat it as a signal to re-secure the account fully: re-enroll your authenticator device and generate a brand new code set immediately, rather than continuing to draw down the remaining old codes.

Are backup codes less secure than my regular 2FA code?

Not inherently. The codes themselves carry strong cryptographic randomness comparable to a session token. The security difference comes entirely from storage, a backup code sitting in an encrypted password manager entry is just as safe as your regular TOTP secret, while one sitting in an unencrypted note is not.