Codes for when your phone is gone
Backup codes let someone sign in when their authenticator app or security key is not available. Each code works once. Most services issue 8 to 10 at a time and let people create a fresh set whenever they run low.
The letters-and-numbers style uses 31 characters without look-alikes, about 40 bits per code. The digits style gives 8-digit codes, about 27 bits. Both are safe because each code works once and logins are rate limited.
Implementing backup codes
- Hash each code before storing it, as you would a password.
- Mark a code as used the moment it succeeds, and show how many remain.
- Creating a new set should cancel the old one.
Frequently asked questions
How many backup codes should I give users?
Ten is common. It covers several lost-device events without becoming a list nobody keeps track of.
Are 8-digit codes secure enough?
Yes for single-use codes behind rate limiting. If your sign-in has no rate limit, fix that first, and prefer the longer letters-and-numbers style.