Securing your Google account with two-factor authentication (2FA) is one of the most important steps you can take to protect your digital identity. Whether you use a text message code, an authenticator app, or a physical security key, 2FA ensures that a hacker cannot access your emails even if they steal your password.
However, this strict security introduces a massive new risk: what happens if you lose your phone? If your phone breaks, drops in a lake, or is stolen while you are travelling, you will instantly lose your ability to generate 2FA codes, effectively locking you out of your own Google account. To prevent this catastrophic scenario, you absolutely must generate backup codes for your Google account.
What Are Google Backup Codes?
Google backup codes are a set of ten unique, 8-digit numbers generated specifically for your account. They act as a fail-safe, offline alternative to your primary two-factor authentication method.
Unlike authenticator app codes which change every 30 seconds, backup codes are static. You can print them on a piece of paper and lock them in a safe. If you ever lose your phone and need to log into Gmail on a new computer, you simply type in one of these backup codes to bypass the 2FA requirement and regain access to your digital life.
Crucially, each backup code can only be used exactly once. After a code is used, it instantly becomes invalid.
How to Generate Your Backup Codes
Generating these codes takes less than two minutes, but it requires you to be currently logged into your Google account on a trusted device.
- Open your preferred web browser and navigate to your Google Account management page at myaccount.google.com.
- In the left-hand navigation menu, click on Security.
- Scroll down to the section labelled How you sign in to Google.
- Click on 2-Step Verification. You will likely be prompted to enter your Google password to verify your identity.
- Scroll down through your 2FA methods until you locate the section titled Backup codes. Click the right-facing arrow next to it.
- Click the button labelled Get backup codes (or Add backup codes).
- Google will instantly generate a fresh list of ten 8-digit codes on your screen.
How to Store Backup Codes Safely
Because these codes can bypass your two-factor authentication, they are highly sensitive. Treating them carelessly completely undermines your account security.
- Print them out: The absolute safest way to store backup codes is offline. Click the Print codes button, print the document, and store the physical paper in a secure location, such as a locked desk drawer or a fireproof safe.
- Download them to a secure drive: If you click Download codes, Google will save them as a plain text file. You should only store this file inside an encrypted vault or a secure password manager. Never leave this file sitting unprotected on your computer’s desktop.
- Never email them to yourself: Emailing backup codes to your own Gmail address is a fatal error. If you are locked out of your account, you will not be able to read the email to get the codes.
How to Use a Backup Code to Log In
When the dreaded day arrives and you have lost access to your primary 2FA device, you can use your backup codes to restore access.
- Navigate to Gmail or any Google service and enter your email address and password as normal.
- When Google asks you for your 2-Step Verification code, look for the link at the bottom that says Try another way.
- Select the option that says Enter one of your 8-digit backup codes.
- Type one of your unused backup codes into the text box and click Next.
You will now be logged into your account. Your immediate next step should be to navigate back to your Security settings and configure a new 2FA method (such as registering a new smartphone).
Generating a Fresh Set of Codes
If you have used several of your backup codes, or if you suspect someone may have seen your printed list, you can invalidate the old codes and generate new ones.
Simply return to the Backup codes page in your Google Security settings and click the circular refresh icon (Get new codes). Google will warn you that your old codes will become inactive. Click OK, and a brand-new list of ten codes will be generated for you to print and store.
