Recovery codes

How they work

Each code works exactly once. On the sign-in code screen, choose Use a recovery code and enter any code you haven't used yet. You're in. The code you used is now spent, and the next time you visit Sign-in & security we'll remind you that you used one, in case you need to set your authenticator app up again on a new phone.

Where to keep them

Somewhere safe that isn't your phone. A password manager works well, and so does a printed copy in a drawer at home. What doesn't work: a photo on the same phone your authenticator app is on (lose the phone, lose both), or a text file sitting on your desktop. The setup screen has Copy and Download buttons to make saving them easy, and we ask you to tick I saved my recovery codes before you can finish. That's not us being fussy; people skip this step and regret it later.

Making a new set

Go to Sign-in & security and choose to make new recovery codes. We'll ask for your password. As soon as the new ten appear, every code from the old set stops working, so throw the old ones away and save the new ones. Do this if you've used most of them, or if you think someone else may have seen them.

Running low

Sign-in & security always shows how many you have left, for example "7 of 10 left". When you're down to 3 or fewer, that count turns into a warning, which is your nudge to make a new set soon. If you use your last one, we'll send you a message saying so. Make a new set right away when that happens, because until you do there's nothing to fall back on if your usual method fails.

Out of codes and can't get in any other way? Read lost access to two-step verification.