Security
Recovery codes: the key you hope never to use
When you turn on two-factor authentication you get ten recovery codes. What they are for, where to keep them, and what happens when you use one.
What they are
Recovery codes are ten one-time codes shown when you turn on two-factor authentication. If you lose the phone your authenticator app is on, a recovery code lets you sign in instead of the six-digit code. Each works exactly once.
Where to keep them
Somewhere safe that is not your phone. Print them and keep the paper with your important documents, or store them in a password manager. Do not keep them in a note on the same phone as your authenticator: if the phone goes, the codes go with it.
Using one
At sign-in, choose to use a recovery code instead of the app code and type one in. It is crossed off at once and cannot be used again. You are told how many remain, and it is a good moment to set your authenticator up again on your new phone.
Keep them private
Treat recovery codes like a password. Nobody at fourdigits will ever ask for one, in any circumstances. If you think someone has seen your codes, create a new set in Settings; the old ones stop working at once.