What do I do if I lose my phone with 2FA?
Generates a batch of backup / recovery codes: 4-20 single-use codes for account recovery when you lose your 2FA device.
The same thing GitHub, Google, GitLab, Microsoft hand out when you turn 2FA on: a printable code sheet to stash somewhere safe.
Each code is cryptographically random, unique within the batch, all generated in your browser.
How to use it
- Code count: 8-10 is the standard (Google ships 10, GitHub 16). Plenty for years.
- Length: 10 chars = sweet spot. 6 for hand-typing, 16+ for paste-only.
- Charset: alphanumeric (without l/1/o/0, easier to dictate), hex (0-9a-f, dev classic), digits.
- Dash format (XXXX-XXXX-XXXX), easier to scan. Plain for paste-friendly.
- Click "Download .txt" or copy all, stash in 2-3 places (safe, wallet, encrypted drive). One copy = too few (lose them and you lose the account).
When this is useful
Six typical situations where a sheet of recovery codes saves you from losing the account:
- Enabling 2FA on GitHub/GitLab/Google/Microsoft. They give you 8-16 codes; here you can generate your own.
- Crypto wallet. Recovery codes in case you lose your Ledger or other hardware key.
- Password manager master. Recovery codes as a last-resort fallback if you forget the master.
- Corporate SSO (Okta, Azure AD). Emergency login codes for when the Authenticator phone goes missing.
- Corporate VPN. Emergency access.
- Any 2FA system where you want a fallback besides the phone.
After generating: save in 2-3 places right away. Don't keep them on the same laptop as your password manager (single attack vector).
Questions and answers
Single-use codes that substitute for 2FA when you lose access to the phone / hardware key. GitHub, Google, AWS, etc. issue them when you set up 2FA. Each code = one login; once used it's burned from the valid list. Hence "backup", a contingency for losing your primary 2FA factor.