Backup codes and trusted devices

What backup codes are for

They are your way in when the authenticator app is not available — a lost, stolen, broken or wiped phone.

Each code is 8 characters, and each one works once. Use one to sign in and it is spent. Your Profile shows how many you have left.

Without them, a lost phone with two-step verification on means contacting us to prove who you are, which is slower and considerably more annoying than saving a list.

Get them and store them

You are given a set when you turn on two-step verification. You can generate a fresh set at any time from Profile → Two-Factor Authentication, and copy them or download them as a file.

Generating a new set replaces the old one, so any codes you had written down stop working.

Where to keep them, in rough order of sensibility:

• A password manager — best, if you already use one.
• Printed, somewhere physically safe — genuinely fine, and immune to losing the phone and the laptop.
• Not on the phone that holds the authenticator. That is the one thing that defeats the purpose entirely.

Use one to sign in

At the code prompt, enter a backup code instead of the six digits. That signs you in and uses the code up.

Do the next part straight away rather than later: set up the authenticator again on your new phone, and generate a fresh set of backup codes. Otherwise you are working through a finite list towards being locked out.

Trusted devices

Marking a device as trusted means it stops asking for a code every time you sign in on it. The point is your own laptop, where the code prompt is friction rather than protection.

Only do it on a device that is genuinely yours and not shared. Never on a public or borrowed machine — a trusted device is one where your password alone gets in.

You can revoke trust for a device, and signing out of everything resets every trusted device at once.

If you have lost the phone and the codes

Then you cannot get in on your own, and that is by design — anything that let you around it would let somebody else around it too.

Get in touch from the email address on the account. Expect to be asked things only the account holder would know; it will take longer than a backup code would have.

If you are still signed in somewhere — another browser, your phone — sort it out from there first. Turn two-step verification off and on again to re-enrol a new phone, or just generate new backup codes. Much easier than proving who you are to us.

Where to go next

Devices signed in to your account shows what currently has access, and how to cut off anything that should not.