Recovery codes
What recovery codes are for, how to create and replace a set, and why they are shown only once.
On this page
Recovery codes are a set of one-time codes you keep for the day you lose your other second factor, such as a phone with your authenticator app. The tab says it plainly: Each code works once, if you lose your other second factor. They sit under the Recovery codes heading of the Two-step verification tab.
A set holds ten codes. Each is a string of ten letters and digits. The platform keeps only a one-way fingerprint of each code, so it cannot show them to you again.
Create the first set#
Your first set can appear in two ways. When you turn on an authenticator app as your first second factor, the page shows the codes straight away. Or you can create them yourself.
A platform operator can also issue a set for an account. The codes you held before stop working, and you are normally sent a notice.
- Open Security, then the Two-step verification tab.
- Under Recovery codes, where the row says No recovery codes yet., select Create recovery codes.
- The page shows a notice titled Your recovery codes: This is the only time they are shown. Store them somewhere safe.
- Save them. Copy codes puts them on your clipboard and says Copied. Download codes saves a text file named
tdacorp-identity-recovery-codes.txt. - Select I have saved them.
The codes are shown once, and they are not stored anywhere you can view later. If you select I have saved them or leave the page without saving, they are gone. Keep them off the device you use to sign in: a password manager, a printed copy in a safe place, or both. Do not store them in the same place as the password they back up.
See how many are left#
The row shows 1 code left, 7 codes left and so on. The same count appears on the Security overview. The Security checkup asks you to make a fresh set when only a couple remain, and counts unused codes as a way back into your account.
Replace the set#
You can create a new set at any time, for example after you have used several, or if you think someone saw the old ones.
- On Two-step verification, select Create a new set.
- The dialog is titled Create a new set of recovery codes? and says The codes you have now stop working.
- Confirm with Create a new set. The new codes are shown once, as above.
A new set replaces the old one completely. Any code from the earlier set no longer works, used or not. A notice that the codes were regenerated goes to your verified addresses. As with other sensitive changes, the page may first ask you to confirm it is you with a passkey, an authenticator code or, where it is offered, your account password.
If you see Your old recovery codes no longer work with Create a new set below., the codes you held from before no longer work. Create a new set.
Use a code#
Where your organization allows it, a sign-in that asks for a second step offers Use a recovery code. Choose it and type one. The page says Enter one of the recovery codes you saved. Each one works once. Each code works one time and is then spent. See Signing in. After you get in with a recovery code, set up your authenticator app again, or add a passkey, and create a fresh set.
Recovery codes are a second factor only. They cannot start a sign-in by themselves: you still need your first step, such as your password or passkey. If you have lost the first step too, use account recovery from the sign-in page.
What can go wrong#
| What you see | What it means |
|---|---|
| The page asks you to confirm it is you | You are signed in without a recent second factor. Use a method the dialog offers: a passkey, an authenticator code or, where offered, your account password. |
| You cannot find your codes | They cannot be recovered. Create a new set, which invalidates the old one. |
| A code is refused at sign-in | It may already have been used, or belong to a replaced set. Try another. |
Managed accounts#
An account that an organization manages (a managed identity) cannot add, change or remove its own sign-in methods here: those requests are refused with Your organization manages this account, so this is not available here. Ask your organization’s administrator., because the organization's directory connection is its only way in.