# 2FA backup codes: what they are and how to keep them safe

Source: https://tempsmsverify.com/blog/2fa-backup-codes · Last updated: 2026-10-24

Backup codes are the spare key to an account protected by two-factor authentication. Most people skip them during setup and only learn what they are when a phone is lost or a number is gone. This guide explains how they work, where to get them for Google, Microsoft, Discord and GitHub, how to store them, and why they matter even more if you signed up with a temporary number.

## What are 2FA backup codes?

2FA backup codes are single-use codes an app gives you when you turn on two-factor authentication. Each one replaces your usual second factor once, so you can sign in if you lose your phone, authenticator app or number. Generate them right after setup, store them offline, and create a new set when they run low.

## Steps

1. **Turn on two-factor authentication.** Use an authenticator app or passkey as the main second factor, not SMS on a temporary number.
2. **Find the backup codes screen.** Look for Backup codes or Recovery codes in the app's security settings, usually next to two-factor authentication.
3. **Generate and download the codes.** Create the set and download or print it. Some apps show the codes only once.
4. **Store them offline.** Keep a printed copy somewhere safe at home and, if you use one, a copy in your password manager.
5. **Test one code.** Sign out and sign in with a backup code to make sure the process works, then note that code as used.
6. **Regenerate when needed.** Create a new set when you run low or think the codes were exposed. The old set stops working.

## How do backup codes work?

When you turn on two-factor authentication (2FA), signing in requires your password plus a second factor: an authenticator app, a passkey, a security key or a code by SMS. Backup codes are a set of one-time codes generated in advance. When you cannot use your normal second factor, you type one backup code instead. Each code works once, then it is spent.

They are deliberately low-tech. A code printed on paper works when your phone is broken, your number has been reassigned or your authenticator app was not backed up. That is exactly why they must be kept away from the devices you would lose.

## Where do you find backup codes for popular apps?

Each service names and formats them differently. These details come from each company's help pages, checked October 2026. Menus move often, so search the help center if a label has changed.

| Service | What you get | Where to find it | Notes |
| --- | --- | --- | --- |
| Google | 10 backup codes of 8 digits | Google Account, Security, 2-Step Verification, Backup codes | Each code works once; getting a new set deactivates the old one |
| Microsoft | One 25-character recovery code | Microsoft account security, Manage how I sign in, Recovery code | Generating a new code makes the previous one stop working; Microsoft advises printing it |
| Discord | A set of single-use backup codes | User Settings, My Account, View Backup Codes (you can also download them) | Use one in place of the authenticator code at sign-in |
| GitHub | 16 recovery codes | Settings, Password and authentication, Recovery codes | Each code works once; generating a new set invalidates the old codes |

## How should you store backup codes?

Store them where you can reach them without the devices you might lose, and where a thief or a piece of malware cannot easily find them.

- Print them and keep the paper with other important documents at home.
- Save a second copy in a reputable password manager, in the entry for that account.
- Do not keep them only in a screenshot, your email inbox or a note on the same phone.
- Label each set with the account and the date, and cross off codes as you use them.
- Do not share them with anyone. No legitimate support agent will ask for a backup code.

## Why do backup codes matter if you used a temporary number?

A temporary number is only yours for a short time; on TempSMSVerify, the number is reserved for up to 20 minutes. If an account later sends an SMS to that number, you will not receive it, and after the number is reassigned, someone else might. That makes the number useless, or even risky, as a recovery or 2FA method.

Backup codes close that gap. If you verified an account with a temporary number, do three things before you log off: set an authenticator app or passkey as the second factor, save the backup codes offline, and remove the temporary number from the account or replace it with one you own. Then losing the number changes nothing.

## What if you lose your backup codes?

If you can still sign in, generate a new set right away; on Google, Microsoft and GitHub, that invalidates the old codes, so a lost copy is no longer a risk. If you cannot sign in, you depend on each service's account recovery process, which can be slow and is not always possible. Discord's and GitHub's help pages both warn that without your second factor or recovery codes, getting back in may require extra verification or may not be possible.

This is the main reason to treat backup codes like a passport: rarely used, but painful to replace.

## Are backup codes enough on their own?

They are a safety net, not the main lock. NIST's SP 800-63B-4 (August 2025) restricts SMS and voice codes as authenticators, and passkeys and authenticator apps are stronger day-to-day choices. Combine a passkey or authenticator app, a recovery email you control and a set of backup codes kept offline. Our pages on /glossary/two-factor-authentication and /glossary/otp explain how each factor works.

## FAQ

### Are backup codes the same as a 2FA code?

No. A normal 2FA code is generated or sent each time you sign in and expires after a short time. Backup codes are created in advance, do not expire on a timer and each work once. They replace your second factor when you cannot use it, such as after losing your phone.

### How many Google backup codes do I get?

Google gives you a set of 10 backup codes, each 8 digits long, from Security, 2-Step Verification, Backup codes in your Google Account. Each code works once. You can get a new set at any time, and creating a new set automatically deactivates the old one, according to Google Account Help.

### Does Microsoft have backup codes?

Microsoft uses a single 25-character recovery code instead of a list. You generate it on the Manage how I sign in page of your Microsoft account security settings. Creating a new code makes the previous one stop working. Microsoft advises printing it and not storing it on a device you use to sign in.

### Where do I find my Discord backup codes?

Open User Settings, make sure you are on My Account, and choose View Backup Codes, which also lets you download them; Discord may ask you to confirm your password. Each code can be used once in place of your authenticator code. Save them when you turn on two-factor authentication, because Discord's help center warns that recovering an account without them is difficult.

### What happens when I run out of GitHub recovery codes?

GitHub gives you 16 recovery codes, and each works once. When you are running low, go to Settings, Password and authentication, Recovery codes and generate a new set. GitHub notes that generating new codes invalidates any you created before, so replace your saved copy at the same time.

### Can I take a screenshot of my backup codes?

You can, but a screenshot on the same phone you use for 2FA defeats the purpose: if the phone is lost, both are gone. Screenshots also sync to cloud photo libraries. Prefer a printed copy at home plus an entry in a password manager, and delete any loose screenshots.

### I used a temporary number to sign up. What should I do now?

Secure the account before the number is gone. Turn on an authenticator app or passkey, save the backup codes offline, add a recovery email you control, and remove the temporary number or replace it with your own. After that, the account no longer depends on a number you will not have.

---
TempSMSVerify · https://tempsmsverify.com