What Are 2FA Backup Codes and Where Should You Keep Them?

Key takeaways

• 2FA backup codes are one-time codes you save in advance. They get you into an account when your phone is lost, broken or out of reach.
• Each service handles them differently. As of November 2026, Google gives 10 codes, GitHub 16, and Microsoft one recovery code. Apple uses a recovery key and recovery contacts instead.
• Keep them in a password manager or printed, with your important documents. Not in a screenshot, an email draft or a note on the same phone.
• Generate a new set after you use some, or if you think anyone has seen them.
• A second number in an app on your phone goes missing with that phone. Backup codes are what cover a lost phone.

2FA backup codes are one-time codes that a service gives you when you turn on two-factor authentication (2FA). If your phone is lost, stolen or broken, or your usual code simply won't arrive, you type a backup code instead and get back into your account. Each code works once.

Most people click past them during setup. Then the phone goes missing, and the account that kept strangers out keeps its owner out too. This guide explains what backup codes are, when to use them, how Google, Microsoft, GitHub and Apple handle them, and where to keep them so you can find them on a bad day.

We make 2Phon, an iPhone app that gives you a real second number for verification codes and calls. One honest point up front: no phone number replaces backup codes, ours included. For the wider picture, see how to receive verification codes safely.

What are 2FA backup codes?

Backup codes are a short list of single-use codes that stand in for your usual second step. Two-factor authentication asks for your password plus one more proof that it's you: a code sent by SMS or voice call, a code from an authenticator app, a security key or a passkey. A backup code is that extra proof, written down ahead of time.

The service makes the codes when you set up 2FA, or later in your security settings. You keep them somewhere off your phone. When the normal route fails, you pick one, type it, and it's used up.

Some services call them recovery codes. The name changes, the idea doesn't: a spare key you hide before you need it. If one-time codes are new to you, start with what an OTP is and how it works.

Two details matter:

• Each code works once. Google says a backup code becomes inactive after you use it to sign in, and GitHub says the same of its recovery codes.
• A new set cancels the old one. At Google and GitHub, generating new codes makes the previous set stop working. That's useful if a copy goes missing.

When do you need a backup code?

Whenever your normal second step is out of reach and you still need to sign in. The common cases:

• Your phone is lost, stolen or broken. Codes by SMS and your authenticator app go with it.
• You changed your phone number and forgot to update an account first. The codes now go to a number you no longer have, and the number may later belong to someone else. See what happens to your old phone number.
• You're abroad and your home SIM is off or has no signal. Our phone number for travel guide suggests saving backup codes before you leave.
• A code just won't arrive, even after you've tried the usual fixes for verification codes that don't arrive.
• Your number was taken over in a SIM swap scam, and the codes now go to a criminal's SIM card. A backup code lets you sign in and change your settings without that number.

A backup code is not for everyday sign-ins. Use your usual method and keep the codes for the day it fails.

How do Google, Microsoft, GitHub and Apple handle backup codes?

Google and GitHub give you a list of single-use codes, Microsoft gives you one recovery code, and Apple uses a recovery key and recovery contacts instead. Here is what each service's own help pages said as of November 2026.

Sources: Google Account Help, Microsoft Support, GitHub Docs and Apple Support, all checked in November 2026. Menu names change from time to time, so look for "backup codes" or "recovery" in the security settings if the path has moved.

Google backup codes

Google backup codes need 2-Step Verification to be on. In the Backup codes section you can get a set, refresh it, download it or print it. Google points out that each code works once, and that a new set makes the old one inactive. It also suggests keeping them in a safe place, for example with your passport or other important documents.

Microsoft recovery code

A Microsoft account has one recovery code rather than a list. You generate it on the "Manage how I sign in" page, and as soon as you create a new one, any previous code stops working. Microsoft's advice is to print the code and keep it in a safe place, and not to store it on a device you use to sign in to the account.

GitHub recovery codes

GitHub lets you view, download, print or copy your recovery codes from your account settings. Each one works once, and generating a new list cancels the old one. GitHub recommends saving them with a secure password manager and not sharing them.

Apple Account: a recovery key and recovery contacts, not backup codes

An Apple Account doesn't hand you a list of backup codes. Apple's support pages describe other ways back in:

• Trusted phone numbers. These are the numbers you set up to receive Apple's 2FA verification codes. A trusted number that isn't on your iPhone, such as a family member's, still works if the phone is lost.
• Recovery contacts. People you choose who can get a six-digit recovery code for you. Apple says they have no access to your account themselves.
• A recovery key. An optional 28-character code. Apple warns that setting one up turns off its standard account recovery process. From then on, you need the key and a trusted phone number to reset your password. If you lose the key, Apple can't give it to you.

Where should you store backup codes?

Store them somewhere you can reach without your phone, and that a thief who has your phone can't open. Those two rules rule out most of the places people actually put them.

Good places:

• A password manager with its own strong password and 2FA. GitHub recommends one for its recovery codes. Put each set in the entry for that account, so you find it in seconds.
• A printed copy, kept with your important documents. Google suggests storing them with your passport. Microsoft suggests printing its recovery code.
• Both, for the accounts you can't lose: your main email, your Apple Account or Google Account, and your password manager.

Watch for the circular trap. Codes for your email can't live only inside that email. Codes for your password manager can't live only inside the password manager. If the only copy sits behind the lock it opens, you don't have a copy.

How to save backup codes, step by step

Do it once per important account, right after you turn on 2FA. It takes a few minutes per account.

1. Turn on two-factor authentication

   Open the account's security settings and look for "2-Step Verification", "two-factor authentication" or "sign-in security". Backup codes usually appear only once 2FA is on.

2. Open the backup or recovery codes section

   Use the paths in the table above, or search the settings for "backup codes" or "recovery".

3. Download, print or copy the codes

   Save them to your password manager, print them, or both. Don't take a screenshot.

4. Label each copy

   Write which account the codes belong to and the date you made them. A list of unlabeled codes is hard to use under stress.

5. Delete stray copies

   If you downloaded a file, move the codes to your password manager and delete the file from your downloads folder.

6. Add a second way in where you can

   An authenticator app, a passkey or a security key next to your phone number means one lost device doesn't lock you out of everything.

What should you do after you use a backup code?

Cross it off, then think about a fresh set. A used code can't be used again, so mark it as used in your password manager or on paper.

Generate a new set when:

• You've used several codes and only a few are left.
• You think someone has seen them: a lost printout, a shared computer, a screenshot that synced somewhere.
• You've just recovered from a lost phone or a SIM swap. Change your password, check the phone numbers and recovery options on the account, and make new codes.

Making a new set is safe at Google and GitHub because the old codes stop working at the same moment. Replace every saved copy, including the paper one, so you never reach for a dead list.

Lost your phone and have no backup codes?

Use the service's account recovery process, and expect it to be slow. Recovery is built to stop strangers, so it asks for proof and takes time. Apple, for example, says account recovery for an Apple Account can take several days or more, as of November 2026.

While you wait:

1. Try every other way in. A trusted second device that is still signed in, an authenticator app on a tablet, a security key, or a recovery contact.
2. Call your carrier if the phone was stolen. Ask them to suspend the line and issue a replacement SIM card for your number, so codes by SMS reach you again.
3. Use the official recovery page only. Anyone who calls or messages offering to "recover" your account for you is running a scam.

Once you're back in, save backup codes before anything else.

Where 2Phon fits

2Phon is a privacy tool for verification codes, not a backup for a lost phone. It's an iPhone app that gives you a real second phone number from dozens of countries. The numbers are real mobile numbers, not VoIP, so the popular apps that verify by phone accept them.

What it does:

• Receives verification codes. SMS codes arrive in the app with a push notification. Voice-call codes work too: choose "Call me instead" and the call rings on your 2Phon number.
• Makes and takes real calls, and the people you call see your 2Phon number, not your personal one.
• Keeps your personal number out of sign-up forms, so one more app doesn't add it to its database.

And what it isn't:

• Not a lost-phone backup. The app is on your iPhone, so while the phone is missing, so are the codes that arrive in it. That's exactly why backup codes matter. We explain the same split in should you use a second number for 2FA.
• Not a home for your most important accounts' recovery. The number is yours to keep while your subscription is active. After a cancellation or a failed payment it may be released and re-assigned. Keep your bank and main email on an authenticator app or passkey, plus saved backup codes.
• Not for texting. 2Phon receives verification codes and handles calls. It doesn't send SMS or MMS, and it's iPhone only.

If that fits, get 2Phon on the App Store — a real second number for verification codes and calls, on your iPhone.

The short version

2FA backup codes are your spare key for the day your phone or your number lets you down. Save them when you turn on two-factor authentication, keep them in a password manager or on paper with your important documents, and make a new set after you use some. Treat the codes for your email and password manager with the most care, because they unlock everything else. For more on handling codes day to day, read how to receive verification codes safely.