Backup codes and recovery codes: save them before you need them
In short
- A backup or recovery code lets you sign in when the text or the phone isn’t there.
- For some apps it’s the only way in: Depop calls its 12-character code the only way to log in without the SMS.
- Save them when you turn on two-step verification, somewhere other than your phone.
When you turn on two-step verification, many apps give you a few backup codes. They feel optional, until the day you need one.
How apps use them
- Depop: a 12-character recovery code, the only way to log in without its SMS code. Using it turns two-factor off, so turn it back on after.
- Snapchat: you need a recovery code to log back in if you lose the phone or authenticator app you set up with.
- Uber and Zoho: backup codes sign you in when texts don’t arrive.
The UK’s NCSC calls backup codes ideal for this, as they work even if you lose your phone.
Where to keep them
Somewhere you can reach without your phone: a password manager, or printed and kept safe at home. Each code usually works once, so get new ones when you’re down to a few.
After a one-time number
If you verified an account with a one-time number from ReserveSMS, that number can’t receive codes after its 20-minute window. Turn on an authenticator app and save the backup codes straight away. See keeping an account after a temporary number.
Common questions
What is a backup code?
A one-use code an app gives you when you turn on two-step verification, to sign in without the usual text or app.
Where should I keep backup codes?
Somewhere you can reach without your phone, such as a password manager, or printed and kept safe.
What happens when I use Depop’s recovery code?
Depop logs you in and turns two-factor authentication off, so turn it back on afterwards.