Keeping recovery codes safe

• Signing in at the second step. Where your organization allows it, on Confirm it is you, choose Use a recovery code, type one of your codes and select Verify. The page says Each recovery code works once.
• Account recovery. The recovery page has an optional I have a recovery code field. See If you are locked out.

They do not replace a passkey or a password. A recovery code on its own is not enough to create a new set or to remove your authenticator app: those changes need a live passkey or authenticator proof.

A set holds ten codes. If you turn on an authenticator app and have no codes yet, the page shows a set straight away. The page then tells you how many remain, for example 9 codes left, or No recovery codes yet.

Treat the codes like a spare house key.

• Keep them somewhere other than your phone alone. If your phone holds both your authenticator app and the codes and you lose it, you lose both.
• A password manager works if it is protected by its own strong passkey or password and is not the thing you are trying to get into.
• A printed copy in a safe place works too, kept apart from the device that holds your authenticator app.
• Do not store them in your email, in a shared document or in a chat. Anyone who reaches that place has your way past the second step.
• Do not photograph them to a cloud album that is easily shared or has a weak sign-in.
• Do not give them to anyone, including someone who says they are TDACorp support. See What identity never asks for.

The downloaded file is a plain text file. Move it into your safe place, then delete it from the downloads folder.

Each code works once, and a used code is gone. The checkup counts your unused codes. The Recovery codes step is good while you hold a few unused codes. When you run low the checkup says Only N unused. Generate a fresh set before you run out. With none ever issued it says No recovery codes have been issued. Generate a set and keep it somewhere safe.

Creating a new set replaces the old one: every old code stops working at once. Do this when:

• you have used most of the set,
• you think anyone else saw the codes,
• you lost the place you kept them.

If an old set no longer works, the page says Your old recovery codes no longer work and asks you to Create a new set.

If someone tries to recover your account with a recovery code and the code is not accepted, the platform emails the account's address with the subject A recovery code was not accepted (English wording shown; the email follows the recipient's saved language). The message says nothing was changed, and suggests changing your password if it was not you. It is a prompt to check, not proof of a break-in.

If a code is refused on the sign-in page, check it and try another code from your set, typing it exactly.

• Choosing a second step
• Security and passkeys