Recovery Backup Codes Generator

When your phone dies or your authenticator app vanishes, a recovery backup codes generator is what keeps a lost device from turning into a lost account. This free tool builds a fresh, random list of single-use credentials in your browser, so you can save or print it long before you need it. Every code works once, which makes the whole list your last-resort way back in to the account it protects.

How a Recovery Backup Codes Generator Works

A recovery code is a short, random string that proves you own an account when your usual second step is gone. The generator draws every character from your browser's cryptographically secure random source, so no character depends on the one before it and nobody, including this page, can predict the next entry. Nothing is uploaded: the list exists on your screen until you copy it or save it. The free multilingual passphrase generator runs entirely client-side — nothing you enter or generate is ever stored or transmitted.

Services treat a recovery code as a stand-alone MFA method, independent of the authenticator app or text message you normally use. That independence is the whole point. A printed sheet still works after a factory reset, a stolen phone or a new number, because it never depended on that device in the first place.

Recovery Code or One-Time Code: What Is the Difference?

The names overlap, and providers use them loosely. A one-time code is valid once and is then dead. A recovery code, on some platforms, is a single long secret that stays reusable and will remain valid after you use it. Read your provider's help page before you rely on either behavior: the generator creates the values, but only the service decides how it treats them.

Most providers hand out a list of one-time-use codes. Each code is numbered, so you can see at a glance which entries are spent and which are still live. Some services add a new set automatically when the list runs out; others make you ask for one.

Multi-Factor Authentication and Recovery Codes

Any account protected by multi-factor authentication has one weak point: the second factor lives on hardware that can break, vanish or be reset. A recovery code is the plan for that day. Everyday speech calls the setup two-factor authentication, and the rule holds there too: a second step you cannot complete is worse than none, unless you hold a way around it. The unambiguous password generator gives you a copy-ready result instantly, with no account required.

Some providers label the list MFA backup codes, others call it a recovery key or a rescue list. The label changes, but the job does not. Specialists accept the trade-off for one reason: a credential that exists only on paper cannot be phished by email and cannot be copied remotely by malware on your phone. Anyone who finds the paper, though, can walk straight through the door, which is why storage matters as much as generation.

Generate a Recovery Code Step by Step

Follow these steps to generate a recovery code list you can actually rely on:

1. Choose how many entries you want and how long each one is. Ten entries of ten characters is a sensible default.
2. Press the generate button and wait for the list to appear. Press it again for a fresh list; the old one is discarded.
3. Copy the result, download it as a text file, or print it before you leave the page, because the tool keeps no copy.
4. Enter one entry in your provider's settings to confirm the service accepts the format, then store the rest.

Set Up Recovery Code Options Before You Generate

Start in your provider's security page rather than the generator. The step to set up recovery code protection usually sits under a heading such as account protection or sign-in methods, and it tells you how many entries the service expects. Match that count and length in the generator, then confirm the match by saving it on the provider's side.

Do not test your newest entry right away. Wait at least one hour after you create it: a recovery attempt made straight after a recent sign in can be blocked by some providers and leave the code unusable for a full day.

Why Random Generation Beats Inventing Your Own Recovery Code

People invent a recovery code from a birthday, a pet name or a keyboard pattern, and attackers try exactly those first. A generator has no habits. Each character is independent, so a stranger who learns your birthday, your street and your favorite team still learns nothing about the next character on your list.

How many entries should you generate? Match what the provider expects, and when it lets you choose, favor a longer list over a longer entry: ten entries leave room for several mistyped attempts without making the sheet hard to store. The generator's count and length inputs exist for exactly this reason, so run it once per account and per person rather than splitting a single list between them.

The same logic explains why you should not reuse one list across services. If two accounts share a credential, the weaker provider decides how well protected both of them are. Generate a separate list for each account, and label each sheet with the account name only.

Worked Example: Entropy of a Backup Code

Strength comes from length and alphabet size, not from how random an entry looks. For an entry of \(L\) characters drawn from an alphabet of \(N\) symbols, the entropy in bits is:

$$\text{bits} = L \times \log_2 N$$

Take an entry of 10 characters from a 32-symbol alphabet that drops look-alikes such as 0, O, 1 and I. Each character carries \(\log_2 32 = 5\) bits, so one entry holds \(10 \times 5 = 50\) bits, or \(2^{50} = 1{,}125{,}899{,}906{,}842{,}624\) possible values.

Now picture an attacker facing ten live entries and a provider that allows 20 guesses an hour. Thirty days of nonstop guessing is \(20 \times 24 \times 30 = 14{,}400\) attempts, so the chance of any hit is:

$$P = \frac{14{,}400 \times 10}{2^{50}} \approx 1.28 \times 10^{-10}$$

That is roughly one chance in 7.8 billion. Shorter entries fare much worse under the same attack, as the table shows.

Going from 6 to 10 characters multiplies the search space by \(32^{4} = 1{,}048{,}576\). That single change is why this tool defaults to ten characters.

Length is not the only lever. Doubling the alphabet to 64 symbols adds one bit per character, so ten characters would hold 60 bits, the same as twelve characters from the 32-symbol set. But look-alike characters then become a transcription hazard on a printed sheet. A 32-symbol alphabet is the practical compromise: it stays readable by hand and still reaches 50 bits in only ten characters.

Generating a Recovery Code Before Upgrading a Phone

A wedding photographer named in this walkthrough only as Dana is upgrading from a three-year-old Android handset on Friday, and the old phone holds the authenticator entries for her cloud storage account, where 41,812 client photos live. Before she wipes anything, she opens the generator to create a recovery code list for that account.

Her provider's security page asks for 12 entries, so she sets 12 entries of 8 characters from the 32-symbol alphabet. The tool reports 8 × 5 = 40 bits per entry. The provider caps guessing at 5 attempts an hour, which over a 90-day window is 5 × 24 × 90 = 10,800 attempts. With 12 live entries the chance of any hit is 10,800 × 12 ÷ 2⁴⁰ ≈ 1.18 × 10^-7, or 1 in 8.5 million.

That clears the 20-bit floor NIST SP 800-63B sets for randomly generated look-up secrets by a wide margin, but Dana still sees that her provider accepts entries up to 16 characters. She changes one input, length from 8 to 10, and runs the numbers again: 50 bits per entry and 10,800 × 12 ÷ 2⁵⁰ ≈ 1.15 × 10^-10, which is 1 in 8.7 billion, a thousand times harder to hit for two more characters.

1. She prints the 10-character list and files it in the document folder in her studio.
2. She saves an encrypted copy in a separate vault, not the storage account itself.
3. She enters entry number 1 at the provider's prompt, waits for acceptance, and crosses it off.

Only then does she reset the old handset. On Friday evening, signing in on the new phone prompts for a second step she cannot complete, and entry number 2 gets her in. The provider flags 11 live entries left, so she generates a fresh list before the weekend rather than wait until the count reaches one.

Store Your Recovery Code in a Safe and Accessible Place

Generating the list is the easy half. A file that sits in your downloads folder next to the account it protects fails the moment that laptop is stolen. Keep a printed copy in a safe and accessible place, such as a fireproof document box, and a second copy as an encrypted file inside a password manager that is separate from the account itself.

• Write down the account name beside the list, but never your login details.
• Never share an entry over chat or text, and do not leave a file on a public computer.
• Keep the sheet in a safe and accessible place at home, not in your wallet, which goes missing as often as the phone it backs up.
• Cross off each entry the moment you spend it.

Treat the whole list with the same care as a spare house key: easy for you to reach, impossible for a stranger to find.

Review the sheet twice a year. Check that it is still legible, that the numbering still matches your provider's current list, and that nobody who once knew where it lives has since moved out or changed jobs. Ten minutes of upkeep is far cheaper than a support request that takes days and asks for proof of identity you may struggle to produce when you are locked out and stressed.

Common Recovery Code Mistakes to Avoid

Most failed recoveries trace back to a handful of habits, and every one is avoidable:

• Photographing the sheet and leaving the picture in cloud photo storage, where anyone who gets into that library gets the list too.
• Keeping the only copy inside the very account it unlocks.
• Never testing one entry, then discovering the format was wrong when the phone is already gone.
• Expecting the generator to produce a crypto wallet key: it creates sign-in entries for a recovery code list, which restores an account path and never controls funds.
• Skipping the refresh after the list runs low, which leaves a single entry between you and a lockout.

Regain Access to Your Account With a Recovery Code

When the day comes, you regain access by opening the provider's sign-in page, choosing the option for trouble signing in, and typing one entry exactly as it is printed. Providers usually ask you to verify it is really you as well, often with a verification code sent to the email address on file. That is why the inbox tied to an account deserves the same protection as the list itself.

After the entry is accepted you may be asked for a fresh account password, and some providers issue new account details such as a new secret key and an emergency kit to save. Expect to sign in again on all your devices afterwards. Self-service recovery is often limited to an individual or family account; team administrators handle business accounts instead. Creating the list does not switch an account into recovery mode; it only prepares the way, so you keep full access in the meantime.

Sign In With a Single-Use Code

Type one entry from your generated recovery code list at the second-step prompt, press continue, and wait. Once you sign in, cross that entry off the sheet so you never try it twice. If the provider rejects it, check for look-alike characters before you try another entry, since each failed attempt counts toward a lockout. Then check your provider's help page to learn whether the entry you just spent is still valid for future use; on most services it is not, and the list shrinks by one.

When You Have Used All but the Last Backup Code

When you have used all but one entry, treat the last backup code as a warning rather than a reserve. A service that issues 12 unique backup codes at the start often hands you 12 new backup codes the moment the final one is spent, numbered in the next sequence, and keeps the old entry live until you confirm the new set. Others show the list only once, so you must come back and generate another batch yourself.

Replace Recovery Code Settings and Delete Old Sets

You can replace recovery code sets whenever you suspect a sheet was seen, copied or photographed. A fresh set will invalidate the previous code list, so save the backup codes you just created before you close the settings page. If you ever delete the set without a replacement and then lose your account details, no support team can restore your access.

If you unlock the account with a passkey, the provider may insist that a recovery path always exists, so you can swap the list for a new one but not remove it. Either way, shred the old sheet after the new one is confirmed.

Frequently Asked Questions

What format are these codes in?

Each code is two 5-character alphanumeric groups separated by a hyphen (e.g. "a3f9k-7bq2m") -- the same general shape used by Google, GitHub, and most other services' account-recovery backup codes.

Can I use these codes with my Google/GitHub/etc. account?

No -- these are standalone, cryptographically random codes for you to store as your own recovery mechanism (e.g. alongside a self-hosted 2FA setup, a password manager, or any system that lets you register custom backup codes). They aren't linked to any specific service's account -- only that service's own "generate backup codes" feature produces codes it will actually accept.

How should I store these codes?

Somewhere separate from the device that normally provides your 2FA codes -- printed and kept in a safe place, saved in a password manager's secure notes, or written down and stored with other important documents. If they're stored on the same device as your authenticator app, losing that device loses both your primary and backup access at once.

Does each code work more than once?

That depends on the system you register them with -- most 2FA implementations treat backup codes as single-use, marking each one as spent after it's used, which is why this tool generates a full set of 10 by default rather than just one.

Are the generated codes sent anywhere?

No. They're generated entirely in your browser using the Web Crypto API's cryptographically secure random number generator -- nothing is transmitted to a server or stored once you navigate away, so make sure to save them somewhere before leaving this page.