If your phone is lost, out of battery or unable to receive a verification prompt, a Google backup code can provide another way to complete 2-Step Verification. The important detail is easy to miss: each code is an eight-digit, one-time code, and it becomes inactive after use.
Create the codes while you can still sign in
Sign in to your Google Account and open Security & sign-in. Under How you sign in to Google, choose 2-Step Verification, then open Backup codes. You may be asked to verify your identity. Google provides a set of ten codes. The feature requires 2-Step Verification to be turned on.
Store them like account keys
Keep the codes somewhere private and available even if your phone is not—for example, a secured password manager or a protected paper copy stored with other important documents. Do not put them in a public note, send them in a message, or share a photo of the page. Google says it will never ask for a backup code except when you are signing in.
At the verification step, choose Try another way and select the option to enter an eight-digit backup code. Use one unused code. Mark it used in your private record so you do not waste time trying it again later.
Regenerate after use or suspected exposure
You can create a replacement set at any time. When you generate a new set, every code from the old set becomes inactive. That is useful if you think a code was exposed, but remember to update your stored copy. Google notes that people enrolled in Advanced Protection cannot download backup codes.
Backup codes are for your Google Account; other services have their own recovery systems. Set up recovery before a crisis and never let a caller or message persuade you to read a code aloud.
Featured image credit: Marc Müller on Wikimedia Commons — CC BY 3.0 de (license).
Leave a Reply