What backup codes are
Backup codes are a list of one-time codes you generate ahead of time, so you can get into an account on the day you don't have the phone that usually sends you the code.
- What it is
- A list of one-time codes
- Since
- 2011
- Verdict
- Yes
What it is
They're a handful of codes you generate once, inside an account's security settings, and keep somewhere separate. If one day you don't have the phone that usually receives the SMS or generates the app code, you type one of these codes instead. Google calls them "alternative verification codes" in its help pages, and most people know them as backup codes. Each code only works once; when you generate a new batch, the old one stops working.
They're the simplest example of a key outside the circle: they don't depend on your phone, an app, or the internet — just on having them on hand, on paper.
When it was introduced
Google launched two-step verification in February 2011, and with it the ability to generate a set of backup codes for when you don't have your phone. Since then, almost every service offering two-step verification includes some variant of this same idea.
Why it's used
It's the cheapest safety net there is: nothing to buy, nothing to install, just generate them and keep them. They solve exactly the problem this test is built around: getting in without the phone you normally use for two-step verification.
The usual trap: saving them as a photo or a note inside the same phone you're trying to protect. That day, the problem and the solution sit in the same place you just lost. That's why they belong on paper, in a drawer, not in a screenshot. And once you use one, it's gone: remember that the list gets used up over time.
Should you use it?
Yes, always, and outside your phone. They're free, they don't expire on their own, and they're the simplest way out when everything else depends on the phone you don't have.
Check this
- Have you generated backup codes for your email and your password manager?
- Are they stored outside your phone, on paper or somewhere physically separate?
- Do you know whether they're still the same ones from a while ago, or if you've ever renewed them?
Official source: Google help: use alternative verification codes