A
recovery code is a code a service may issue so you can regain access if you lose your phone, security key or authenticator. Some services call these backup codes. Many are single-use; the exact rules vary by provider. Anyone with a valid code may be able to use it to recover your account.
Quick example
Your phone is lost while traveling. Your account asks for the authenticator app on that phone. A saved backup code lets you sign in and register a replacement method.
What to do
Generate codes before you need them. Store them in a secure place separate from the device they back up, such as a trusted password manager or a protected offline copy. Do not send them by chat or store them in an unprotected screenshot. After using one, check how many remain and regenerate if the provider recommends it.
NIST's authentication guidance treats account recovery as a separate, sensitive path.
Practical distinction
A recovery code is a spare key, not a routine sign-in code. If someone asked you to reveal one, treat the account as potentially exposed and replace the codes through its official settings.
