What Are Backup Codes? The List You Clicked Past, and Where It Should Actually Live

There is a screen almost everyone clicks through. You turn on two-factor authentication, the service shows a block of random codes, tells you to keep them somewhere safe, and you press Continue. Months later your phone is gone and that screen is the only thing that would have helped.

What they actually are

A backup code, also called a recovery code, is a single-use credential that stands in for your second factor. Not for your password: you still need that. It replaces the thing you no longer have, which is usually the phone running your authenticator app or the security key sitting in a drawer in another country.

GitHub's documentation is precise about the mechanics and worth quoting rather than paraphrasing. It provides 16 codes, and states that "once you use a recovery code to regain access to your account, it cannot be reused". When all sixteen are spent, you generate a fresh list. Other services give different counts, so treat sixteen as GitHub's number and not as a universal one.

The advice that collapses your two factors

Here is where the standard guidance gets uncomfortable. GitHub tells you not to share or distribute the codes, and recommends "saving them with a secure password manager". That is sensible against the most common failure, which is losing a scrap of paper. It also has a consequence worth stating plainly.

Your password lives in that vault. If the codes live there too, then anyone who opens the vault holds both factors: the password, and the thing that replaces the second factor. The separation that made two-factor authentication worth turning on has quietly gone.

That is not an argument against password managers, and it is not a reason to ignore the advice. It is a reason to decide deliberately rather than by default.

Where they can reasonably live

Printed and stored physically is unfashionable and works: a sheet in a drawer at home, or with documents you already keep secure. A second password manager, separate from the one holding the account's password, keeps the two factors apart. A device that is not the one you authenticate with, kept offline, does the same.

What does not work is a note on the phone that runs the authenticator app, or an email to yourself in the account those codes protect. Both put the rescue inside the thing you are being rescued from.

The scenario they exist for

Think through the actual failure. Your phone is lost, stolen, dropped in water, or wiped by a repair shop. Your authenticator app went with it, and unless you exported the seeds, the codes it generated are gone. At that moment you need either a second security key, or the backup codes, or a support process that may take days and may not succeed.

This is also why a second security key and backup codes are not redundant with each other. The key is what you use every day when the first one is unavailable; the codes are what you use when both are.

After you use one

Because each code is spent on use, a list quietly shrinks. Most services let you regenerate the whole set, which invalidates the old one. Doing that after a recovery is the tidy habit: you know how many you have left, and any old copy floating around becomes useless.

If you never enabled two-factor authentication in the first place, none of this applies yet, and that is the more urgent gap.

The honest summary

Backup codes are the least interesting part of a security setup and the part most likely to decide whether you keep an account. They cost five minutes once. The only real decision is where to put them, and the default answer, next to your password, is the one that deserves a second thought.