Free Online Recovery Code Generator

Recovery codes are one-time backup codes for getting into an account when your normal sign-in method is unavailable, for example when you lose the phone that holds your authenticator app or your security key. Each code works once, so they act as a spare key kept for emergencies.

Every character comes from your browser’s cryptographically secure random number generator (crypto.getRandomValues), picked with rejection sampling so every allowed character is equally likely. The page loads no outside scripts, its content security policy blocks outgoing network requests, and nothing is saved, so the codes exist only on your device until you close the page.

Strength is measured in bits of entropy, which the page shows under the generator. The default of 16 Crockford Base32 characters carries 80 bits. Shorter formats such as 10 hex characters (40 bits) or 8 digits (about 27 bits) are only reasonable because services limit guesses and accept each code once. Aim for 64 bits or more when you can choose.

Crockford Base32 is the recommended default: it leaves out I, L, O and U, so codes are easy to read from paper and type. Base58 is more compact but case-sensitive. Hexadecimal and digits-only match formats some systems expect, but need more characters for the same strength. Letters and numbers, or letters, numbers and symbols, are available when a system requires them, though look-alike characters and symbols make typing mistakes more likely.

Eight to ten is typical. The odds figure under the generator shows the chance that one random guess matches any of your codes, and at 64 bits or more even a full set of 50 keeps that chance negligible, so the number is mostly about convenience. Replace the whole set once you have used several.

Usually not. Most services create their own recovery codes and accept only those, so use the codes the service gives you. This tool is for software you build or host, for personal backup secrets such as the key to an encrypted archive, and for systems that let you supply your own code.

Keep at least two copies in different places: an entry in a password manager (ideally not protected only by the account the codes unlock), a printed sheet in a safe or other locked place, or an encrypted file or drive. Avoid unencrypted notes, email and screenshot folders, and do not keep the only copy inside the account they protect.

Replace them after you have used one, if you think anyone may have seen them, when you change your main sign-in method, and now and then as routine housekeeping. On most services creating a new set cancels the old one, so check that before you discard the old copies.

Show each code to the user once, store only a hash, and accept each code a single time. Because these codes are random with 64 or more bits, a fast hash such as SHA-256 is adequate. Normalize what the user types (remove hyphens and spaces, fix the case for Base32), compare in constant time, rate-limit attempts, cancel the whole set when a new one is issued, and tell the user when a code is used. The optional SHA-256 column on this page hashes each code without hyphens, exactly as stored.

No. Codes are created on your device, the content security policy blocks outgoing network requests, no outside scripts are loaded, and none of what you create is saved in cookies or local storage (the page only remembers your chosen site language). Printing uses this page rather than a pop-up window, and the print sheet is removed afterwards. Closing or reloading the tab discards the codes, so save what you need first.