Recovery codes

Recovery codes are the way back in when the authenticator app is gone. You get ten when you turn on two-factor authentication, and each one works once.

They are shown once

The codes are stored as SHA-256 hashes, never as the codes themselves. That is the point: a database nobody can read a code out of is a database that cannot leak one. It also means the screen that shows them is the only time they exist in readable form. Print them, or put them in a password manager — somewhere that is not the laptop you would be locked out of.

The account page shows how many are left, not what they are.

Using one

On the two-factor screen at sign-in, choose Use a recovery code instead and enter one. A code that has already been used is refused, and so is a code that never existed; the message is the same either way.

Generating new ones

New recovery codes on the account page gives you a fresh ten and invalidates the whole previous batch — including the ones you never used. There is no way to add one code to an existing set, because a set you have partly lost is a set you should be replacing.

Generate a new set if you think someone has seen the old ones, and use Sign out other sessions at the same time.

What a recovery code does not do

A recovery code gets you past the two-factor screen in the app. It does not raise the underlying session’s assurance level with the authentication service, because there is no API for telling that service “this person proved themselves another way”. The service goes on regarding the session as password-only for its whole life.

In practice that is invisible today — everything gated on the second step accepts the application-level pass. It matters for one reason: a recovery code is a way back in, not a replacement for the authenticator. Once you are in, set the authenticator up again on the new device and generate a new set of codes.

If you have lost the codes and the app

Nobody at Tincograph can read your codes or your secret, so there is no support path that hands them back. Write to us from the address on the account through the contact form and we will tell you what can be done from our side, which is less than you would like.

This is the trade in every honest second factor: the thing that stops someone else getting in also stops us letting you in.