When you turn on the authenticator app, we give you 10 backup codes. Each one works once, in place of a code from your app.
They are shown exactly once
This is the part to take seriously. The codes appear on screen immediately after you enable two-factor authentication, and that is the only time you will ever see them.
We store them hashed, the same way we store passwords, which means we cannot show them to you again and neither can support. There is no "resend my backup codes". If you close that screen without saving them, they are gone.
Where to keep them
- In your password manager, as a secure note on the same entry. Best option for most people.
- Printed, somewhere physically safe. Old fashioned and completely effective.
- Not only on the phone that has your authenticator app. That is the device most likely to be lost, and losing it takes both things at once.
- Not in a plain note or an email to yourself. Anyone reading that inbox gets past your second step.
Using one
At sign in, choose to use a backup code instead of your app, and enter one. It is consumed at that point and will not work a second time.
Keeping track of how many are left
Your Profile shows how many unused codes you have. Worth a glance occasionally. If you are down to one or two, generate a fresh set.
Getting a new set
Turn two-factor authentication off and on again. You get 10 fresh codes and every old code stops working immediately.
Do this if you have used most of them, or if you think someone else may have seen them.
Turning two-factor off deletes them
Disabling the authenticator app removes all of your backup codes along with it. That is the intended behaviour: codes that bypass a second step should not survive the second step being removed.