Recovery Codes
A set of one-time codes generated at account creation or first login and stored offline by the user for account recovery. They function as proof of possession and are required to be single-use, to have sufficient entropy, and to be stored only as hashes on the system side.
Timeline (last 90 days)
Account recovery methods recognized by SP 800-63B-4 include four categories: recovery codes or backup codes, registered authenticators or devices, out-of-band communication channels, and human-assisted identity verification.
The key implementation points for recovery codes are that codes must be single-use, have sufficient entropy, and be stored only as hashes on the system side.
The suggested migration roadmap: inventory processes that depend on security questions, remove security questions from new user registration and guide users to set up recovery codes or bind authenticators, and prompt existing users to add recovery methods and set a transition period.
For products already using multi-factor authentication, migration resistance is lower, because registered authenticators and out-of-band channels often already exist and only need to be connected to the recovery flow; for products that have not yet established an authenticator system, recovery codes are the lowest-barrier entry point.
All Facts (4)
Account recovery methods recognized by SP 800-63B-4 include four categories: recovery codes or backup codes, registered authenticators or devices, out-of-band communication channels, and human-assisted identity verification.
50%UnverifiedThe key implementation points for recovery codes are that codes must be single-use, have sufficient entropy, and be stored only as hashes on the system side.
50%UnverifiedThe suggested migration roadmap: inventory processes that depend on security questions, remove security questions from new user registration and guide users to set up recovery codes or bind authenticators, and prompt existing users to add recovery methods and set a transition period.
50%UnverifiedFor products already using multi-factor authentication, migration resistance is lower, because registered authenticators and out-of-band channels often already exist and only need to be connected to the recovery flow; for products that have not yet established an authenticator system, recovery codes are the lowest-barrier entry point.
50%