What backup codes are and when to use them
If you are locked out of your Google account, backup codes can be a fast way to regain access without waiting for a phone or authenticator prompt.
This guide explains how to recover Google account with backup codes and what to do if the codes are unavailable.
Google backup codes are one-time recovery codes generated in your Google Account security settings.
They are especially useful when you cannot complete two-step verification with a phone, security key, or Google Prompt.
How Google backup codes work
Backup codes are part of Google’s two-step verification system, also called 2FA.
Each code can be used once, and after a code is entered successfully, that specific code becomes invalid.
- Codes are typically 8 digits long.
- They are generated in a set, often 10 codes at a time.
- Each code should be stored securely, because anyone with a valid code can access your account.
- Once used, a code cannot be reused.
Google supports multiple sign-in and recovery methods, including Google Prompt, SMS verification, authenticator apps, security keys, and backup codes.
Backup codes are most valuable when your primary second factor is unavailable.
How to recover Google account with backup codes
To recover your account, go to the Google sign-in page and enter your email address and password as usual.
When Google asks for a second verification step, choose the option to enter a backup code if it appears, or select another way to sign in and look for the code entry option.
- Open the Google sign-in page or the app you are trying to access.
- Enter your Gmail address or other Google account email.
- Enter your password.
- At the two-step verification prompt, select Use backup code or Try another way if needed.
- Type one unused backup code exactly as issued.
- After successful sign-in, immediately review your security settings.
If the code is valid, Google will let you into the account.
If you have several backup codes saved, you may need to try another one if the first code was already used or entered incorrectly.
Where to find your backup codes
If you prepared in advance, your backup codes may be stored in one of several places.
People commonly save them in a password manager, print them and keep them in a secure location, or store them in an encrypted file.
- Password managers such as 1Password, Bitwarden, or Dashlane
- Printed copies in a locked drawer or safe
- Encrypted notes or secure cloud storage
- Personal security documents kept offline
Do not search random email inboxes or unsecured text files unless you know exactly where you stored them.
Backup codes should be treated like passwords because they can unlock your account.
What if your backup codes do not work?
There are several reasons a backup code may fail.
It may already have been used, typed incorrectly, expired because you generated a new set, or belong to a different Google account.
- Check for typing errors and extra spaces.
- Make sure you are using a current code set.
- Confirm you are signing into the correct Google account.
- Try another unused backup code from the same set.
If none of your codes work, use Google’s account recovery process.
This may include verifying your identity through recovery email, recovery phone, prior passwords, or device-based checks.
Google’s system evaluates account ownership signals, so recovery success depends on the information linked to your account.
How to get a new set of backup codes after recovery
Once you regain access, generate a fresh set of backup codes immediately.
This is important if the old codes were lost, exposed, or partly used.
- Sign in to your Google Account.
- Open the Security section.
- Select 2-Step Verification.
- Find Backup codes.
- Generate new codes.
When Google creates a new set, the old codes are generally invalidated.
That helps reduce risk if a previous copy was compromised.
Save the new set somewhere secure and accessible in an emergency.
How to store backup codes safely
Safe storage is critical because backup codes bypass your normal second-factor protection.
Store them in a place that is private, durable, and easy for you to reach when needed.
- Use a reputable password manager with strong encryption.
- Keep one printed copy in a secure physical location.
- Do not share codes by email, chat, or screenshots.
- Avoid cloud notes that are not protected with strong access controls.
If you manage sensitive accounts for work or family, consider keeping an emergency access plan documented for trusted people.
For example, a family digital estate binder or a company incident response procedure can help ensure account access during emergencies.
When backup codes are not enough
Backup codes only help if you already saved them before getting locked out.
If you never generated them, or if you lost every copy, you will need Google Account Recovery instead.
Recovery may be more difficult if you have also lost access to your recovery email, recovery phone, or trusted device.
In that case, complete as many verification steps as possible from a familiar device, network, and location to improve your chances.
Best practices to avoid being locked out again
After you recover access, strengthen your account so future sign-ins are easier and safer.
Google recommends keeping multiple recovery options up to date and reviewing security activity regularly.
- Add and verify a recovery email address.
- Add a recovery phone number you actually use.
- Keep at least one trusted device signed in when possible.
- Use a password manager to store your Google password.
- Review your Google Security Checkup regularly.
It also helps to understand common account protection tools from Google, including the Google Account Security page, 2-Step Verification, authenticator apps, and device prompts.
Using more than one recovery method makes account access more resilient if one method fails.
How to recover Google account with backup codes on mobile devices
The recovery process is similar on Android and iPhone.
During sign-in, Google may display a backup code entry screen or a menu of alternate verification methods.
If you use the Gmail app, Google Chrome, or another Google service, the same account verification rules apply.
Make sure your device is connected to a stable internet connection and that you are entering the code from the correct account.
If the app redirects you to a browser, follow the same sign-in steps there.
Common mistakes to avoid
Small errors often cause recovery problems.
Avoid these common mistakes when using backup codes.
- Using a code from the wrong Google account
- Entering a used code again
- Confusing backup codes with recovery codes from another service
- Deleting or overwriting saved codes after generation
- Storing codes in an insecure location
Google backup codes are a practical emergency tool, but they work best as part of a broader security plan.
If you keep them organized and update your recovery settings, you will have a much better chance of signing back in quickly when access problems occur.