Recovery codes
Single-use backup codes saved when you enable MFA, so losing your phone or security key does not permanently lock you out.
What it is
Recovery codes are a set of high-entropy, single-use secrets issued when someone enables MFA. They are the offline spare key for the day a phone is lost, an authenticator is wiped, or a security key is unavailable. Each code bypasses the missing second factor once, not the account's first-factor check.
Issue several at enrollment, show them once, and encourage saving them in a password manager or printing them. Store only a keyed digest of each normalized code, mark one used in the same transaction that finishes login, and let a signed-in user regenerate the whole set after fresh authentication.
The gotcha is treating them like harmless convenience data. Anyone who copies one has a working second factor, so never email the set, log it, or let support read it back. Regeneration must revoke every old unused code, and using one should trigger an audit event and a notification so the account owner knows the spare key was used.
Ask AI for it
Add MFA recovery codes using Node.js `crypto.randomBytes`. Generate 10 independent 128-bit values, encode each in a human-readable base32 format with groups separated by ASCII hyphens, and display the complete set exactly once after MFA enrollment. Store only an HMAC-SHA-256 digest of each normalized code with a server-held pepper, plus `used_at`. On login, compare the submitted digest, mark the matching code used in the same database transaction that advances authentication, and reject replay. Require fresh authentication to regenerate codes, revoke the entire previous set, offer print and download actions without sending codes to analytics, and notify the user after any code is used.