Backup Codes for Google: How to Generate, Use, and Store Them Safely

Getting locked out of your Google Account is more disruptive than most people anticipate — especially when your phone is lost, stolen, or dead and your usual two-factor authentication method is suddenly unavailable. Google backup codes exist precisely for this scenario: a set of pre-generated, single-use emergency codes tied directly to your Google Account, giving you a guaranteed path back in when every other 2FA method fails.

This article covers what backup codes are, how to generate them, how to use them at sign-in, how they differ from Google Authenticator codes, and where to store them so they are actually useful when you need them.

What Are Google Backup Codes?

Google backup codes are a set of 10 unique, 8-digit one-time-use codes generated by Google as an emergency authentication fallback. When your phone is unavailable — due to loss, damage, or a carrier issue — these codes let you complete the two-factor authentication step without a device. Each code works exactly once and is immediately invalidated after use.

These codes are tied to your entire Google Account, not just Gmail. They work across Google Drive, Google Workspace, YouTube, and any other service authenticated through your Google identity.

How to Generate Google Backup Codes (Step-by-Step)

On Desktop

1. Open a browser and go to myaccount.google.com.
2. Click Security in the left-hand navigation panel.
3. Scroll to How you sign in to Google and click 2-Step Verification.
4. Re-enter your password if prompted.
5. Scroll down to Backup codes and click Set up (or Show codes if you’ve generated them before).
6. Google displays your 10 backup codes. Click Download to save them as a .txt file, or Print for a physical copy.

On Mobile

1. Open the Google app or go to myaccount.google.com in your mobile browser.
2. Tap Security, then 2-Step Verification.
3. Scroll to Backup codes and tap Set up or Show codes.
4. Save or note the codes before closing the screen.

Pro tip: Generating a new set of backup codes immediately invalidates your entire previous set — including any unused codes. If you have 7 codes remaining and generate a new batch, those 7 are gone. Always update your stored copy the moment you regenerate.

How to Use a Backup Code to Sign In to Google

1. Enter your email address and password as normal.
2. When Google prompts for two-factor verification, click Try another way beneath the primary prompt.
3. Select Enter one of your 8-digit backup codes.
4. Type the code exactly as written — no spaces required.
5. Google authenticates you and marks that code as used.

Each of the 10 codes can only be used once. After use, it disappears from your available pool permanently. This single-use design prevents replay attacks where an intercepted code could be reused. A backup code is the fallback; normally Google sends a one-time Google verification code by text or shows a prompt on your phone.

Understanding what a verification code actually is helps clarify why backup codes behave differently from the rotating codes you receive by SMS or authenticator app.

Backup Codes vs. Google Authenticator Codes: What’s the Difference?

Google Authenticator generates six-digit verification codes using the TOTP standard — a time-based algorithm defined in IETF RFC 6238 that refreshes every 30 seconds. Backup codes are static and pre-generated. Use Authenticator codes for daily authentication; reserve backup codes for when your phone is inaccessible.

Where to Store Your Google Backup Codes Safely

Storage quality determines whether backup codes are useful in a crisis.

• Print and store physically — Keep a printed copy in a locked drawer, safe, or secure filing cabinet at home.
• Download to an encrypted drive — Save the .txt file to an encrypted USB drive or encrypted folder on your computer.
• Password manager — Store codes in the secure notes field of a reputable password manager for a second layer of encryption.
• Avoid — Unencrypted email drafts, plain-text notes apps, or screenshots in unprotected cloud photo libraries.

Common mistake: Storing backup codes inside the Gmail account they protect. If you’re locked out of Google, you’re also locked out of Gmail — making those stored codes completely inaccessible.

Anyone with these 10 codes can access your account without your phone or password. Treat them with the same care as a physical house key.

For how other platforms handle the same concept, see backup codes for a cross-platform overview.

What to Do When You Run Out of Backup Codes

Return to Security → 2-Step Verification → Backup codes and click Get new codes. Google generates a fresh set of 10, and any remaining codes from the previous set are immediately invalidated.

Regenerate proactively when you have 2 or fewer codes remaining, rather than waiting until you hit zero. After regenerating, immediately replace the old stored copy — printed or saved — with the new set. An outdated sheet creates false confidence.

What to Do If You’re Locked Out and Have No Backup Codes

Google’s account recovery process at accounts.google.com/signin/recovery is the only path forward, and it is not instant.

Decision framework:

• Trusted device available → approve sign-in directly from that device
• Recovery phone or email configured → use the verification code sent there
• Neither available → submit the Account Recovery form; expect a 3–5 business day wait with no guaranteed outcome
• Google Workspace account → contact your domain administrator, who can reset 2FA from the Admin console

The recovery flow uses identity verification steps including trusted devices (any device where you’ve previously approved a “Is this you?” prompt), recovery email or phone, and account history questions about recent activity, creation date, or previously used passwords.

NIST Special Publication 800-63B on digital identity guidelines explicitly recommends maintaining multiple authenticator options because single-point failures are predictable. Recovery form outcomes depend heavily on verifiable account history — accounts with sparse activity have lower recovery rates.

Frequently Asked Questions

Where do I find my Google backup codes? Go to myaccount.google.com → Security → 2-Step Verification → Backup codes. You must have 2-Step Verification already enabled.

Can I reuse a Google backup code? No. Each code is invalidated immediately after a single use.

Are backup codes the same as Google Authenticator codes? No. Backup codes are 8-digit static codes generated in advance. Authenticator codes are 6-digit time-based codes that refresh every 30 seconds.

What happens if I lose my phone and need to sign in to Google? Use a stored backup code. If you have none, go through Google’s account recovery process, which may take several days.

How do I generate new backup codes after using them all? Return to Security → 2-Step Verification → Backup codes and click Get new codes.

How many backup codes does Google give you? Google provides exactly 10 backup codes per generation.

Do Google backup codes expire if unused? Unused codes do not expire on a time basis. They remain valid until used, until you generate a new set, or until you disable 2-Step Verification.

Conclusion

Google backup codes are 10 single-use, 8-digit codes that provide guaranteed access to your Google Account when your primary 2FA method is unavailable. They are not a replacement for your authenticator app or SMS codes — they are the last-resort fallback that prevents a lost phone from becoming a permanent lockout.

Generate your codes before you need them. Store them somewhere physically or cryptographically secure and separate from the account they protect. Regenerate when your supply drops to 2 or fewer, and update your stored copy immediately every time you generate a new set.

Two minutes of setup now eliminates what can otherwise become a 3–5 day account recovery process with an uncertain outcome.