AltF Authenticator
2FA backup codes
Backup codes are single-use codes that let you sign in when your authenticator is not available. Real backup codes must come from each service's security settings. This page generates random codes for your own system or as a template, and gives a checklist for storing the real ones.
- Free, no sign-up
- Secrets stay in your browser
- RFC 6238 self-test built in
- Works on mobile
Get the real codes from each service
Google, Microsoft, GitHub, Apple and most other services offer backup or recovery codes in their security settings, usually as a list of 8 to 16 one-time codes. Each code works once. The codes generated on this page are not linked to any of those services and cannot unlock them.
Storage checklist
- Keep at least one copy offline, such as a printed sheet in a safe place at home.
- Keep it away from the phone that holds your authenticator, so one loss does not take both.
- A password manager entry is a good second copy, if the manager itself is not protected only by the same phone.
- Do not keep them as a photo in your camera roll or in your email.
- Cross out each code when you use it, and make a new set when you run low.
- Make new codes after any scare. Making new codes usually cancels the old ones.
For developers building backup codes
- Generate them with a secure random source, as this page does with crypto.getRandomValues.
- Store only a hash of each code, like a password, and mark codes used as soon as they work.
- Show them once, and offer download and print, since people rarely copy them by hand.
- Rate-limit attempts and tell the user by email when a backup code is used.
2FA backup codes: questions and answers
Can I use these codes to sign in to Google?
No. Google backup codes come only from your Google Account security settings. These are random codes for your own use.
Where is the best place to keep backup codes?
Printed and stored somewhere safe at home, plus an optional second copy in a password manager that is not locked by the same phone.
Do backup codes expire?
Usually not, but each one works only once, and generating a new set normally cancels the old set.
Are the codes sent anywhere?
No. They are generated in your browser. Downloading creates a local .txt file.
Authenticator tools and 2FA guides
Guides
AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.