Backup Codes Get You Back In
Lost your phone? Backup codes are one-time codes for the second sign-in step. Print a copy, store it somewhere safe offline, and never share it.
- Backup codes are one-time codes for the second sign-in step, for when your normal verification method is unavailable.
- Save them when shown for the cases Google names: you lose your phone, change your phone number, or cannot get codes by text, call, or authenticator app.
- Print a copy and store it somewhere safe, like where you keep your passport or other important documents — never on a device you use to sign in.
- Never share backup codes. If you lose them, run out, or think they were stolen, create a new set — the old set becomes inactive.
Lost your phone? Your accounts do not have to be lost with it, if you saved your backup codes.
A backup code is not your password. It is a spare way through one specific step, kept for the day the normal way does not work.
What backup codes are
Backup codes are one-time codes for the second sign-in step. Google describes using a backup code for that second step when you cannot sign in with your normal 2-Step Verification.
CISA puts the wider point plainly: a password is not enough on its own. Multi-factor authentication adds a second layer of identification beyond a password. A backup code belongs to that second layer. It stands in for the usual second step when that step is unavailable.
Microsoft uses similar language for its account recovery code, which helps you regain access to your account. The job is the same: a code saved in advance, used when the normal method cannot reach you.
Save the codes when a service shows them to you. Waiting until the phone is already gone is too late.
When you need them
Google names the cases directly. Create backup codes to use in case you lose your phone, change your phone number, or otherwise cannot get codes by text, call, or Google Authenticator.
A lost phone takes the device that receives the code. A changed number breaks the route the code was sent to. A text, call, or authenticator app that does not deliver leaves you with no second step to complete.
In each case, the account still asks for the second step, and your normal verification method is unavailable. A saved backup code is the code you use for that step instead.
That is why the work happens now, while you can still sign in normally.
Get The Field Briefing — plain-English breach alerts and practical guides like this one, in your inbox.
One code, one use
Each backup code works once. After you use a backup code to sign in, that code becomes inactive. It does not stay live for the next problem, and it should not be treated as a standing code you can reuse.
The set itself can also be replaced. You can get a new set whenever you want. When you create a new set, the old set automatically becomes inactive. Microsoft states the same rule for its recovery code: a new one means previous codes no longer work.
That replacement rule matters for safety as well as access. A new set is a clean break from the old set — once it exists, the old set no longer works.
How to stay safe
Store your backup codes somewhere safe. Google gives the comparison directly: like where you keep your passport or other important documents. To do that, you can print a copy of them.
Microsoft gives the same print advice for its recovery code: print it and keep it in a safe place. Microsoft adds the device rule: for security, do not store the code on a device used to sign in to your account.
Never share your backup codes with anyone. Google states its rule by name: "Google never asks for a backup code other than at sign in." Treat anyone asking you to hand over a code outside sign-in as a reason to stop, not a reason to comply.
Do the setup today, in this order. Open one important account. Save its backup codes. Print a copy. Store that copy somewhere safe offline, with the kind of care you give important documents, and not on a sign-in device.
For related reading, see MFA fatigue and passkeys explained. If an account is already out of reach, see also account recovery.
If you already did it
In this topic, "already did it" means the codes themselves are the problem: you lost them, you ran out of them, or you think they were stolen or exposed.
Work the one sourced remedy. Create a new set.
Google gives that step for exactly those cases: if you lose or run out of codes, or if you think your backup codes were stolen, you can create a new set. Do not keep relying on a set you no longer control, and do not keep using a set you believe someone else may have seen.
Creating the new set does the second half of the job for you. When you create a new set, the old set automatically becomes inactive. Microsoft states the same for its recovery code: a new code means previous codes no longer work.
Once the new set is created, store it the safe way above: print a copy, keep it somewhere safe like your important documents, and keep it off a device you use to sign in.
Sources: Google Account Help — Sign in with backup codes ↗ · Microsoft Support — How to get a Microsoft account recovery code ↗ · CISA — Shields Up: Guidance for Families ↗
Desk takeaways
Save your backup codes when a service shows them to you, print a copy, and store it somewhere safe offline — like where you keep your passport — never on a device you use to sign in. Each code works once, and you should never share one. If you lose your codes, run out, or think they were stolen, create a new set right away — the old set becomes inactive.
Get the Field Briefing — free, plain-English breach alerts the day they land: https://buttondown.com/redflagcyber
Join the conversation
Have you opened one important account today and saved its backup codes somewhere safe offline? Drop a yes or not yet in the comments — never share the codes themselves.