Recovery code
A recovery code is a secret used in an account-recovery process to help restore access when a subscriber cannot use their usual authenticators.
Saved and issued codes
You may save recovery codes when setting up an account, or receive one when you need to recover it. NIST calls these saved recovery codes and issued recovery codes. Issued codes go to a recovery address you established beforehand.
Under NIST’s saved-code requirements, the service invalidates a code after use and issues a replacement. Issued codes have expiration limits that depend on their delivery channel. Check your service’s documentation to see how it handles these codes.
“Recovery code,” “backup code,” and “MFA code” are not interchangeable labels across services. A code used for a normal sign-in may be a different kind of authenticator from a secret used to recover the account. Check what the code actually lets you do.
Keeping recovery codes secure
Find out how the service creates codes, where users should store them, and when they stop working. For delivered codes, check how the recovery address was established and whether it can be changed during the same request. A recovery code may be only part of the required verification. Under NIST’s AAL2 requirements, recovery needs two codes from different recovery methods, a code plus a bound single-factor authenticator, or repeated identity proofing for an account that was identity-proofed.
Recovery codes are secrets. Keep them out of screenshots, support notes, and assessment reports.