Backup codes, and where to keep them

Backup codes are single use passwords that stand in for your authenticator app. They exist for one situation: your phone is lost, broken, wiped or on the other side of a locked door, and you need to sign in now.

How they behave

• You receive a set when you enable two factor authentication.
• They are shown once, at that moment. We store only hashes, so they cannot be shown to you again and we cannot recover them.
• Each works exactly once. Using one consumes it.
• Using one is written to your audit log as Backup code used, so an unexpected entry there is a real signal.

Using one

At the two factor prompt, enter a backup code instead of the six digit code. You are signed in as normal. Set up your authenticator again on your new device as soon as you can.

Where to keep them

Somewhere that survives the loss of your phone, which rules out the phone.

• Best: a password manager that syncs to more than one device, in the entry for this site.
• Also good: printed and kept where you keep your passport. Old fashioned, and it works during a house move, a flood and a flat battery.
• Acceptable: an encrypted file on a computer that is backed up.
• No: a note on the phone that holds the authenticator, an unencrypted email to yourself, a photo in your camera roll.

Regenerating them

Under Security, choose to regenerate. A fresh set is issued and every previous code stops working immediately. Do this if you think a code has been seen by someone else, or if you have used most of the set and want a full one back.

If you have lost both

No phone and no codes means manual recovery: write to support from the email address on the account. It is deliberately slow, because a quick path around two factor authentication would make the whole thing pointless. Armed vaults keep counting down while this is sorted out, so say so in your first message if a deadline is close.