The short version: a recovery code is a backup code that gets you into your account if your phone is gone. Make your codes today, keep them in a safe place that is not your phone, and never read one to anyone who contacts you.
The worry is reasonable
Many people worry: “What if I lose my phone?” Preparing takes a few minutes.
What recovery codes are
A recovery code is a backup way into your account if your phone is gone or broken. Google and Facebook give you a set of codes, and each one works once. Some services call them backup codes. Microsoft and Apple work differently: they give you one long code or key to keep safe. A second step is the extra check you do after your password, such as a code from an app on your phone. See two-factor authentication and recovery code.
Where to get them
Look in your account’s security settings.
- Google. In your Google Account, go to Security & sign-in, then 2-Step Verification, then Backup codes. Google gives 10 codes. Each has 8 digits and works once. If you make a new set, the old set stops working.
- Microsoft (personal account). Go to account.live.com/proofs/manage/additional. Under Recovery code, choose Generate a new code. It is one 25-digit code, not a set. A new code makes older codes stop working. Microsoft says you cannot look up an old code later. You use it if you forget your password or your account is compromised (hacked). If two-step verification is on, Microsoft says you must wait 30 days for changes to take effect.
- Apple. Apple has a recovery key, a 28-character code. It is optional. Apple says that if you set one up, you turn off Apple’s standard account recovery. If you then lose the key, you can be locked out permanently. Read Apple’s page before you decide. It is in Settings, your name, Sign-in & Security, Recovery Key.
- Facebook. In Accounts Center, go to Password and security, then Two-factor authentication. Choose your account, then Additional methods, then Recovery codes. Facebook gives 10 codes. Each works once.
Where to keep them
Keep your codes in a safe place that is not on your phone. Google suggests the place where you keep your passport or other important papers.
- On paper. Print the codes or write them down. Keep the paper somewhere safe at home. Bitwarden says this about its own recovery code: a printed copy kept in a safe place prevents digital theft and accidental deletion.
- In your password manager. Many password managers have a secure notes feature, and Bitwarden says you can keep a service’s recovery codes there. Use this only if you can open your password manager without your phone. Keep the password manager’s own recovery code on paper instead.
Avoid keeping codes in an email to yourself, in a screenshot in your photos, or on a sticky note, because other people could find them. Instagram’s own help page suggests taking a screenshot of its codes. We advise against it. Copy the codes to paper and delete the screenshot. This is our advice, not Instagram’s.
Microsoft says not to store the code on a device you use to sign in. Apple says not to store its recovery key in the Passwords app, Notes, iCloud Photos or iCloud Drive. Keep the key somewhere else. Apple says you can use more than one safe place.
If you lose your phone
- Sign in with a recovery code. For Google or Facebook, choose another way to sign in at the second step and enter one code. Each code works only once, so cross it off your list. For Microsoft, choose Other ways to sign in, then Forgot password, and follow the steps until it asks for your recovery code.
- Move your authenticator app. Set it up again on your new phone. Read authenticator apps.
- Make new codes. Generate a new set after you sign in. The old set may stop working.
- Remove the lost phone. In your account’s device list, remove or sign out the old phone.
- If you have no codes, use the service’s own recovery steps. Microsoft has an account recovery form. If you use a passkey, it may also be on your other devices.
If you lose both your codes and your second step, some services cannot let you back in. Bitwarden says you may be locked out of your vault. Apple says you can be locked out permanently if you set up a recovery key and then lose it.
Backups of the things you need
A backup is a copy of your important files stored somewhere else. A backup can be on the internet (cloud storage) or on removable media, such as an external hard drive.
CISA’s guidance for small businesses describes the 3-2-1 rule. The same idea works at home:
- 3 copies of important files
- 2 different kinds of storage, such as a hard drive and the cloud
- 1 copy away from your home
A simple plan: turn on your phone’s backup, and copy your photos and key documents to a second place. Check that your backup has all your important data in it. Protect your cloud account with a second step, because anyone who can open it can open your backups.
Extra safety nets
- Recovery email and phone. Add a recovery email address and phone number to your account. Google says they help you recover your account.
- Apple recovery contact. You can choose a person you trust who can help you get back in. They get a code for you. They do not get access to your account.
- Legacy or trusted contacts. Apple’s Legacy Contact is for after your death only. Apple says it does not include your iCloud Keychain passwords and passkeys. Google’s Inactive Account Manager acts after a death or a period of no use that you choose. This is not legal advice.
Stay safe
Never give a recovery code or a verification code to someone who calls or messages you. Anyone who asks for your code is a scammer. If someone asks, hang up. Then contact the company using a phone number you trust, such as the one on your statement or in its app.
One case is different. With an Apple recovery contact, you ask your own trusted person for the code, and you start the request yourself.
If you lose money, report it. US: reportfraud.ftc.gov. UK: Report Fraud (formerly Action Fraud) at reportfraud.police.uk or 0300 123 2040. Scotland: call Police Scotland on 101. Related: secure your email and the 30-minute account cleanup.
Do this today (about 7 minutes for one account)
- Open the security settings of your main email account.
- Generate the backup or recovery codes for your Google or Microsoft account. For an Apple Account, skip the recovery key unless you have read Apple’s page first.
- Print them and keep them in a safe place that is not your phone. A password manager’s secure note is another option if you can open it without your phone.
- If you already saved codes, a new set cancels the old one. Destroy the old copy only after the new one is saved.
Never type a code or password into this website, and never read a code out to someone who contacts you.
Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.
