Recovery codes are single-use backup credentials that let someone log in when their normal second factor — an authenticator app, a security key, an SMS code — is unavailable. When a user enables two-factor authentication, the service typically hands them a set of ten codes to print or save in a password manager. If they lose their phone, one of those codes gets them back in. This tool generates a batch of cryptographically random codes in the familiar xxxx-xxxx style used by GitHub, Google, and similar services, entirely in your browser.
How it works
Each code is built from secure random bytes, then mapped onto a clear, unambiguous character set:
- Draw random values from
crypto.getRandomValues— the browser’s cryptographically secure RNG. - Map each value onto an alphabet that omits visually confusing characters (no
0/Oor1/l/I) to reduce transcription errors. - Insert a hyphen at the chosen group size to make the code readable, producing forms like
a8k3f-2m9qz.
Because each code is generated independently from secure randomness, knowing one code tells an attacker nothing about the others.
Storage and lifecycle
- On the server, store each code hashed with a slow password hash and a per-code salt — never in plain text. Mark a code as consumed the moment it is redeemed.
- On the user side, codes belong somewhere reachable without the primary device: a password manager, a printed sheet in a safe, or an encrypted note.
- Treat the set as single-use: each code authenticates exactly one login. Prompt the user to regenerate a fresh set when most are spent.
Everything here runs locally, so generated codes never touch a network — copy them straight into your enrollment flow or test fixtures.