A key you might need years from now
Recovery keys get you back in when everything else fails: a lost phone, a forgotten master password or a dead hardware key. They are usually printed or written down, so they should be easy to read and copy by hand, yet long and random enough to resist guessing.
The default is 8 groups of 4 characters in Crockford Base32, which leaves out I, L, O and U to avoid confusion. That is 32 characters and 160 bits of entropy.
Storing recovery keys
- Print it or write it on paper and keep it somewhere safe and separate from your devices, like a home safe.
- Keep a second copy in a different place, such as with a trusted family member.
- Never store a recovery key inside the account or device it is meant to recover.
Frequently asked questions
Can I use this for my own app’s account recovery?
Yes. Show the key to the user once, store only a hash of it, and let them create a new one after it is used.
Why the groups?
Groups of four are much easier to read aloud, type and check than one long string. The separators are only for readability and can be changed in the options.