🗂️ Backup Codes Generator

Generates a printable set of one-time backup codes, the kind services offer as a fallback if you lose access to your two-factor authenticator. Each code is meant to be used once. Save or print them somewhere safe — this page keeps nothing after you leave it.

Number of codes

Format

What each format is worth

Codes are drawn character by character with rejection sampling on crypto.getRandomValues, so there is no modulo bias and every character is equally likely. Strength is the plain entropy formula, bits = log2(charset^length):

8 digits        log2(10^8)  = 26.6 bits
XXXX-XXXX       log2(32^8)  = 40 bits
10 characters   log2(32^10) = 50 bits

The 32-character set leaves out O, I, 0 and 1, which is why a character is worth exactly five bits and why nobody misreads a printout.

Using a set properly

Duplicates are filtered out, so every code in a batch is distinct.
Cross a code off as you spend it. The point of one-time codes is that a shoulder-surfed or logged code is already dead.
Print or download beats a screenshot in your photo roll, and a password manager entry beats both if you can still reach it without the account.

These codes are not accepted by Google, GitHub or any other provider - only the service itself can issue codes its own login will honour. Use this when you are the one building the recovery flow, or for a self-hosted system.

Frequently asked questions

How many backup codes should I keep?

Ten is the usual set size and the default here. Enough that losing one or two does not lock you out, few enough to fit on a card you actually store somewhere safe.

Are 8-digit backup codes strong enough?

On their own, only just - 26.6 bits is 100 million guesses. They hold up because the login attempt is rate limited and each code dies after one use. If your system has no throttling, use the 10-character format at 50 bits.

Do these codes get sent anywhere?

No. They are generated in your browser, and the copy, download and print buttons all work on data that never leaves the page. Close the tab and the set is gone, so save it first.