Backup Codes Generator
Free backup codes generator — one-time recovery codes for two-factor authentication, grouped for readability and downloadable as a file. Generated locally by a cryptographic random source; nothing is uploaded.
Each code is single-use. Store them somewhere you can reach without the account they protect.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Recovery codes for two-factor authentication
A backup code is a one-time password you hold in advance, so that losing your second factor does not lock you out permanently. Services generate a set when you enable two-factor authentication; each code works once, and using one usually invalidates it immediately.
The circular storage trap
The most common mistake is saving backup codes in the same password manager that the second factor protects. If that vault is what you have lost access to, the codes are inside the locked room. Keep them somewhere with a different failure mode — printed on paper, in a different vault, on a device you do not carry.
Grouping
Codes are grouped with hyphens because they are read and typed by humans, often from paper and often under stress. Three groups of four is the common shape; more groups of fewer characters is easier to read back, fewer groups is faster to type.
Frequently asked questions
What are backup codes for?
They are the way back in when the second factor is gone — phone lost, authenticator app wiped, hardware key left in a drawer. Any service offering TOTP should offer these too, and the moment to save them is when you enable two-factor authentication, not when you need them.
How should I store them?
Not in the password manager that the second factor protects — that is a circular dependency, and it fails exactly when you need it. Print them and put them somewhere physical, or store them in a different vault on a different device. Treat each one as a single-use password equal to the account.
How many codes should I generate?
Eight to ten is standard. Each is single-use, so the count is how many times you can recover before you must generate a fresh set. Generating more does not add security; it adds copies of a credential to keep safe.
Are these codes registered anywhere?
No — and this is worth being clear about. This tool generates random codes; it cannot enrol them with any service. Use it when you run the service, or when a system asks you to supply your own recovery codes. For a normal account, use the codes the provider itself issues.