Generate secure backup/recovery codes for two-factor authentication with configurable format and quantity.
This tool prints a list of one-time recovery codes, the kind a two-factor login asks for when your authenticator app is lost, broken, or just reset. You choose the character set (digits, lowercase, uppercase, or mixed), the grouping and separator (for example XXXX-XXXX), and how many codes to produce. Each character is drawn independently at random, so one run gives you no information about the next. Everything happens in your browser and nothing is uploaded. The thing users get wrong: generating codes here does not register them with any account. They only work with a service that accepts user-supplied codes, or as a practice set.
Every character position is chosen uniformly from the set you selected. A six-digit numeric code has exactly 1,000,000 possibilities, while ten mixed alphanumeric characters give 62^10, roughly 8.4 x 10^17. Codes are drawn independently, so one leaked code reveals nothing about the rest; the strength of the set is set by your length and character-set choices, not by the tool.
You set the quantity, the characters per group, the number of groups, and the separator (hyphen, space, or none). The result is a list you can copy as plain text into a password manager or print as a paper card. Every run yields a different set, so the only list that matters is the one you actually registered or stored; generate once and keep that copy.
No. Those services generate their own backup codes when you enable two-factor authentication, store them hashed on their side, and accept only codes they issued. A list you generated elsewhere will not be recognized. Use this tool with services that accept user-registered codes, or for testing.
Treat each code as one recovery login, and generate enough to last until your next re-enrollment. Most services issue sets of 8 to 16 codes. A set of 12 to 20 leaves headroom for rare use over a couple of years; the only cost of more codes is storing a longer list safely.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.