2FA backup codes: what they are and where to keep them
By the Novaz team · Updated October 9, 2026 · Novaz steps checked against version 1.0.3
When you turn on two-factor authentication, most websites also give you a short list of backup codes. Some call them recovery codes. Each one lets you sign in once without your authenticator app. They're what gets you back in if your phone is lost, broken or reset. Without them, you depend on the website's account recovery, which can take days and sometimes fails.
How they work
- Each code works once. After you use it, it's crossed off. Google, for example, says that once used, "that code becomes inactive".
- Getting a new set cancels the old one on most websites. Keep only the newest set.
- You type one in place of the app's code. On the sign-in screen, look for "Try another way", "Use a backup code" or "Use a recovery code".
What you get from some well-known services
| Service | What you get | Good to know |
|---|---|---|
| 10 backup codes, 8 digits each | A new set makes the old set inactive (Google) | |
| GitHub | 16 recovery codes | You can download, print or copy them. A new set invalidates the old codes (GitHub) |
| Microsoft account | One recovery code, which Microsoft describes as "a 25-digit code" | Generating a new one stops the old one working at once (Microsoft) |
| 10 recovery codes | Each works once. Get more with "Get new codes" (Facebook) | |
| Discord | 8-digit backup codes, saved as discord_backup_codes.txt |
Discord support can't make new ones for you (Discord) |
Where to keep them
The rule that matters most: not only on the phone that has your authenticator app. If you lose that phone, you lose both at once. Microsoft says it plainly: "do not store the code on a device used to sign in to your account".
Good places, from the providers' own advice:
- On paper, with your important documents. Google suggests keeping a printed copy "somewhere safe, like where you keep your passport or other important documents".
- In a password manager. GitHub and Discord both recommend this.
One thing to think about with a password manager: if it also holds your 2FA codes, losing access to it loses both. Keep a printed copy as well for your most important accounts, such as email, Apple Account and banking.
Places to avoid:
- A screenshot in your Photos library, which may sync to every device you own.
- An email to yourself, or a notes app on the same phone.
- Anywhere other people can see, such as a shared drive.
When to get a new set
- When you've used several of them.
- If you think someone else might have seen them.
- After you recover your account. Old codes may still be around somewhere you no longer control.
When you get a new set, destroy the old copies so you don't confuse the two.
With Authenticator App - Novaz
Novaz keeps your setup keys only on your iPhone and has no backup or export. Backup codes are your safety net if that iPhone is lost. A simple habit: every time you scan a new QR code into Novaz, save that website's backup codes before you close the page. If you've already lost the phone, see Lost the phone with your authenticator app?