Backup codes: what they are and where to find them

Backup codes are one-time codes a service gives you when you turn on two-factor authentication. You can use each one once instead of the code from your authenticator app or a text message, so you can still sign in when the phone is lost, broken or wiped. You can only see them while you're signed in, so get them now, not on the day you need them.

Where each service keeps them

• Google: Google Account › Security › 2-Step Verification › Backup codes. You get ten 8-digit codes. Google Account Help
• Instagram and Facebook: Accounts Center › Password and security › Two-factor authentication › your account › Additional methods › Backup codes. Instagram step by step
• Discord: User Settings › My Account, then View Backup Codes. Discord asks for your password first and marks the codes you've used.
• Microsoft account: no list, just one long recovery code. You make it at account.microsoft.com under Security, in the advanced security options. A new one replaces the old. Work and school accounts don't have one; there, your IT department can reset two-factor authentication.
• GitHub: Settings › Password and authentication › Recovery codes › View. 16 codes you can download or print. GitHub Docs
• Apple Account: no backup codes. Apple sends the code to your other Apple devices or your trusted phone number. You can turn on a 28-character recovery key, but if you lose it and your devices, you can be locked out for good.

Worth knowing

Each code works once, so cross it out after use. Getting a new set cancels every old code, including the ones you printed. A backup code stands in for the code from your app, not for your password; you still need that.

And the one that catches people out: you can only see or make codes while you're signed in. Once you're locked out, it's too late.

Where to keep them

Not only on the phone they're meant to replace. Print them and keep the sheet with your passport, or save them in a password manager you can also open on your computer. A screenshot in Photos is better than nothing, but it sits on the same phone, and photos sync to places you may not think about.

Locked out with no codes

Then you depend on the service's account recovery. It can take days, and you'll have to show the account is yours. With Google, start from the sign-in page, ideally on a device you've used before and from somewhere you usually sign in. On Instagram, use the help link on the login screen. Some services can't help at all: Discord says its support can't remove two-factor authentication without a code or another method.

Kode

Kode is an iPhone authenticator app by Peter Theill ($1.99 once). Your keys stay in the iPhone's Keychain and, if you like, in iCloud Keychain, so a new iPhone gets them back, and the app can save an encrypted backup file. Backup codes are still worth keeping: they're the way in when every device is gone at once.