Backup codes and account recovery

The most common two-step problem is not an attack. It is a new phone and no way back in.

Before something goes wrong

1. Save the backup codes that a service shows when you turn on two-step sign-in. They are single-use codes (NIST calls them look-up secrets). Keep them somewhere separate from your phone: printed in a safe place or in a password manager.
2. Add a second method if the service allows it: a second authenticator app on another device, or a security key.
3. Note the recovery options: some services offer a recovery email, a trusted contact or an identity check.
4. Do not keep the only copy of the secret on one phone. When you set up a new entry, some apps let you save the setup key: keep it as carefully as a password.

When you change phones

Set up the new phone before you wipe the old one. For each account, either move the entry with the app's transfer feature, or turn two-step sign-in off and on again to get a fresh secret. Test a login before you reset the old phone.

If you are locked out

1. Use a backup code.
2. Use another sign-in method you set up.
3. Use the recovery process of the service. It can take days, because the service must make sure that it is you.

Cautions

• Support scams. A message or call that says it can restore your account for a fee, or asks for your codes, is a scam. A real service never asks you to read out a one-time code.
• Do not share backup codes with anyone.
• Recovery is a way in, so services guard it with extra checks. Do not be surprised by a delay or by questions that only you can answer.

This is an independent guide. It is not connected with the IETF, NIST, CISA, any authenticator app or any company named here. Facts were read on 14 November 2026 from the documents named on each page; codes and examples were calculated with Python and with the page's own code, and checked against the RFC test vectors.