Google backup codes: create, store and replace a recovery set
Find Google’s backup-code controls, keep the recovery copy outside the lost phone and understand what happens when a code is used or a set is replaced.
In brief
Backup codes are a supported alternative when the normal second factor is unavailable. For Google, used codes cannot be reused, and generating a new set replaces the previous set.
Keep the recovery route independent of the phone and account access it is meant to rescue.
Prepared from the linked primary documentation. Examples explain a procedure or calculation; they are not a device benchmark or a hands-on product review.
Choose a genuinely separate location
A secure password manager, protected offline record or other suitable method can work, depending on your recovery model. Do not make the only copy depend on signing into the account whose MFA you may lose. Include enough account context to recognize the set without exposing passwords beside it.
Understand how the service uses them
Read the official login instructions and available “try another way” option before an emergency. A code is not something to give a support caller or giveaway operator. If you test a live code, expect it to be consumed and update your record accordingly.
Keep one current set
If codes are exposed, regenerate through the official account controls and secure the account. Replace printed and stored old copies so you do not rely on invalid values later. When changing phones, confirm the normal authenticator works as well; backup codes support recovery rather than replacing routine account hygiene.
Find the Google controls before you need them
Open your Google Account directly, choose Security & sign-in and find 2-Step Verification. Under Backup codes, follow the prompts to view or generate the supported set. Google may ask you to sign in again; the available controls can differ on a managed account.
During recovery, start on Google’s own sign-in page and use Try another way when offered, then the backup-code option. A request to read a code to a caller is a different situation: do not hand over a valid recovery code.
Illustrative example
A note stored only inside the Google account being recovered is a circular plan: you may need the code to open the account that holds the code. Choose a protected route you can still reach when that phone or account is unavailable.
| Event | What to do |
|---|---|
| You use one code | Mark it as used in the private record |
| You generate a new set | Replace the old stored set; those old codes no longer work |
| You lose the phone | Retrieve the independent copy through your planned route |
| Someone may have seen the codes | Secure the account and replace the exposed set |
Documentation for these steps: Google Account Help — backup codes ↗
Before you act
Anyone holding a valid code may be able to use it with the required sign-in information. A screenshot in a broadly shared photo library or an unprotected note is not suitable storage.
What to do next
- Open the account’s security settings directly and find its backup-code controls.
- Generate or retrieve the supported set and store it in a secure independent location.
- After use, replacement or exposure, update the stored record and remove obsolete copies.
