Prepare before you need the spare
Google’s current help explains that backup codes work with two-step verification. An unused code can provide an alternative sign-in step; once used, it becomes inactive. Creating a fresh set also invalidates the old set. These are credentials with a lifecycle, rather than permanent reference numbers. [1]
- Stored: keep it private and reachable
- Used: that code no longer works
- Replaced: follow your service’s rules
Store them as something valuable
Google says not to share backup codes and suggests keeping a printed copy somewhere safe. Login.gov likewise tells users to treat recovery codes with the same care as a password. Its guidance explicitly warns that written codes are vulnerable to theft and phishing, and describes them as its least secure two-factor option. [1] [2]
Follow the service’s own rules
Login.gov supplies one-use codes after the password step. Google’s instructions differ in their replacement details and note an Advanced Protection limitation. The practical step is to review your own service’s official guidance while you still have access, including how codes are replaced. Neither service’s instructions establish a universal recovery process. [1] [2]
Go a little deeper
Optional reading · about 1 more minute
The copy you cannot reach
Hypothetical example: If the only copy of a backup code is inside the account you are locked out of, it cannot help you complete that sign-in. When choosing secure storage, consider how you would reach it if your normal device were unavailable.
A backup is not permission to disclose it
Our interpretation: Treat a request to send someone your backup codes as a request for account access. The word “backup” describes why you keep the credential; it does not make it safe to publish, message or include in a support screenshot.
Original sources
Attributed synthesis, not original reporting. Examples labeled hypothetical or illustrative are explanatory. Reviewing a source does not independently validate its findings.
- Google Account Help: sign in with backup codes ↗
Live official help read September 28; no publication date displayed. One-use rule, replacement, storage, non-sharing and Advanced Protection exception checked.
- Login.gov: backup codes ↗
Live official help read September 28; no publication date displayed. One-use, password step and theft/phishing limitations checked. Service-specific guidance.
