Google Backup Codes and Passkeys: Sign-In Beyond One Phone

If a single phone receives every verification code for your Google Account, that phone effectively is your account. Lose it, drop it, or reset it before checking what depended on it, and the second step you added for protection becomes the thing standing between you and your own mail. Google backup codes and passkeys are the two practical answers, and both have to exist before the bad day rather than after it.

This page covers where the codes live, why each one works a single time, how a passkey on a second device signs you in, and what Google documents trying when either method refuses. Every factual claim below comes from Google’s own help pages, linked where it appears.

Google backup codes: what they are and where to find them

A backup code is a short one-time string you type in place of a prompt, an app code or a text message. It is the one second step that keeps working when the handset is gone, because it lives wherever you put it.

Getting a set from your 2-Step Verification settings

Google’s backup codes page gives the route. Open your Google Account, go to Security and sign-in, and select 2-Step Verification under the heading for how you sign in to Google. You may need to sign in again at that step. Then, under Backup codes, click Continue. The controls appear on the screen after that, labeled Get backup codes, Refresh, Delete, Download Codes and Print codes.

The entry is only there once 2-Step Verification itself is on. If you do not see it, the 2-Step Verification page points at the control in the same place: under how you sign in to Google, select Turn on 2-Step Verification.

Ten codes, each used once

Codes arrive as a set of ten, and Google says you can get “a new set of 10 backup codes whenever you want”. Each is single use. Google’s wording: “After you use a backup code to sign in, that code becomes inactive.” The 2-Step Verification page describes them as “8-digit backup codes” that you can print or download to keep in a safe place. One limit comes attached to that on both pages: you cannot download backup codes if you are in the Advanced Protection Program, so print them instead.

Ten sounds generous until you treat the set as a login method rather than an emergency measure, and the moment you reach the end you need to be able to sign in to issue more.

A new set cancels the old one

This is the detail that strands people. Google states: “When you create a new set of codes, the old set automatically becomes inactive.” There is no overlap and no grace period: a printout from last year stops working the instant somebody taps the button for a fresh set. So replace the old copy at the same time. Two printouts in two drawers, one of them silently dead, is worse than one printout you trust.

Finding a downloaded codes file

If you downloaded rather than printed, the file has a predictable name. Google says the download follows the pattern Backup-codes-username.txt, using your username, and gives Backup-codes-google123.txt as an example. Search your downloads folder for “Backup-codes”, provided the file is on the computer you are searching.

Google suggests keeping a printed copy somewhere secure, such as with your passport, and warns not to share your backup codes with anyone. An image sitting in the gallery of the very phone that generates your prompts fails both of those tests at once.

Google backup codes not working

Almost every failure here is bookkeeping rather than a fault.

The code was already used or replaced

Those two rules explain most rejected codes. If the whole sheet fails rather than one line, suspect the second: somebody pressed the button for a new set.

Entering it on the backup-code screen

Codes do not go in the password box. Google’s path is to sign in, click Try another way, then choose “Enter one of your 8-digit backup codes”, and type an unused one. Google also recommends marking each code as used once you enter it.

When to use another second step instead

If the codes are exhausted or outdated, any other second step on the account gets you in, and once you are in you can issue a current set. The 2-Step Verification page lists what might be waiting there: Google prompts, passkeys and hardware security keys, verification code apps, and codes by text message or voice call.

How to set up a passkey on your Google account

A passkey moves the proof from something you remember to something your device holds and unlocks. It is the method most worth adding if your only second step today is a text message.

Creating a passkey from the Passkeys page

Google’s passkeys page sends you to myaccount.google.com/signinoptions/passkeys, where you select Create a passkey and unlock the device to finish. To have a passkey on another device, Google says to repeat these steps on that device.

Where the passkey then lives decides whether it is really a second way in. Google Chrome Help states that passkeys are backed up and synced to your Google Account and are available across your devices through Google Password Manager, and it names the exceptions: a passkey under Windows Hello stays on that computer, and passkeys stored on security keys are not backed up. So a synced passkey is convenient, and it returns on a replacement device once you sign in to the same Google Account, but everything synced that way hangs off that one account. A FIDO2 security key, or a printed set of codes, does not.

Phones, computers and hardware security keys

Google lists the hardware that can hold a passkey:

Signing in on a computer with a passkey on your phone

You do not need a passkey on the computer in front of you. Google documents the cross-device route: enter your username on the sign-in page, click Try another way, then Use your passkey, and scan the QR code that appears using your phone’s camera or a QR scanner app. Turn Bluetooth on before you start: Google’s requirement is that to use a passkey on a phone to sign in to another computer, turn on Bluetooth, and its step list repeats the check after the scan. On the phone, tap Use passkey to sign in, or Sign in with a passkey on an iPhone or iPad, then verify with face unlock or your PIN.

Gmail passkey sign-in: what changes

Adding a passkey changes what Google asks you for.

A passkey skips the second step

With 2-Step Verification on, Google says “your passkey bypasses the second authentication step, since this verifies that you own the device”. That is not a downgrade, because the unlock on the device is doing the second-factor work. Google notes your other authentication and recovery factors stay in place, so codes and keys you added earlier are still there.

The Skip password when possible setting

Google’s account settings include an option called Skip password when possible, under how you sign in to Google. Turn it off and your password becomes the default at sign-in; you can still use a passkey as the second step if you use 2-Step Verification.

Removing a passkey from a lost device

Google names two reasons to remove one: you lost a device, or you created a passkey on a shared device by accident. The route is Security and sign-in, then Passkeys and security keys, then select the passkey and choose Remove.

Removing the passkey closes the shortcut, but a device that is still signed in keeps its session until you end it, which is what signing a lost device out of your Google Account walks through.

Gmail passkey not working

Passkeys fail quietly, and Google publishes requirements rather than a troubleshooting list. What follows stays on that documented ground.

Cross-device QR sign-in problems

Check Bluetooth first. Google’s steps for this path say to turn Bluetooth on, and then to check it is on again after the QR code is scanned, so a code that scans and then goes nowhere is most often this.

Check the sequence next. The path on a computer is Try another way, then Use your passkey, and only then does the QR code appear; people often look for a code on the first screen and conclude the feature is missing. Google’s stated minimum for the phone is Android 9, iOS 16 or up.

If a passkey you already removed keeps being offered, Google’s page points somewhere else entirely: check whether it is in a third-party credential manager you use, and remove it there too.

Falling back to backup codes or another method

Choose Try another way and pick a method you still hold: an unused backup code, an authenticator app, a security key, or a prompt on a device that is working.

Google 2-Step Verification without phone access

If the phone is gone or broken, these are the routes Google names.

Security keys and passkeys on other devices

A passkey on a laptop, or a FIDO2 hardware key on your keyring, both sign you in with no handset involved. Of everything here, a key or a second-device passkey is least likely to be affected by whatever happened to the phone.

Authenticator codes

A verification code app is a listed second step, and its codes live on whichever device holds the app. The catch is that the app usually lives on the same phone as everything else, which is why the day you change handsets is the day this breaks. The steps are a guide of their own, covered in moving Google Authenticator to a new phone.

Backup codes kept away from the phone

Google is direct about the lost-phone case on the 2-Step Verification page: if you lose your phone, you can use a backup code for the second step. That only holds if the codes are somewhere else. Printed in a drawer, or in a password manager you can reach from a second device, both count.

Why a Google Voice number isn’t a recovery phone

Google’s recovery options page draws a hard line here: the one number it tells you to keep out of that field is a Google Voice number. Pick an ordinary mobile line in your own name instead. The same page warns that the field is not instant either: a recovery phone you add or edit can need up to 7 days before it takes effect, so handle it today rather than mid-crisis.

A prevention checklist before something goes wrong

Two methods that don’t depend on the same phone

Count your methods by device, not by name. A prompt, an authenticator app and an SMS code all on one handset is one method wearing three hats. Pair something on the phone with something that is not: a passkey on your laptop, a FIDO2 key, or a printed set of codes.

Recovery email and phone you control

Google’s recovery options sit under Security and sign-in. For the email, Google recommends an address you use regularly that is different from the one you sign in with. For the phone, a line in your own name that you intend to keep. A number you borrowed, rented or bought from anyone is a future lockout, and Google’s rule about Voice numbers is the mild version of that lesson.

Gmail accounts you manage for a team

Shared logins are where all of this falls apart, because no single person is accountable for the second step. Look at the sanctioned route first. A Workspace domain keeps the mailboxes with the organization, and an administrator can reset a user’s password or generate backup verification codes for someone shut out of their second step, with nobody hunting for a printout. Price that before anything else.

Sometimes the honest requirement is still a handful of ordinary consumer mailboxes, for QA runs or sign-up testing that cannot sit inside a domain. The cost of holding several is the one this page is about: every mailbox wants its own code set and its own passkey, kept somewhere that is not the one phone in the office drawer. PVAVRT’s Gmail account grades are split by the window an account was created in and the country label it carries. New (Fresh PVA) is $1 an account, five is the smallest order, and PVAVRT states it tests logins before delivery. Do the codes and the passkey on arrival day, before the account gets used for anything.

Say the plain part as well. Buying Google accounts goes against Google’s rules. Google’s Terms of Service prohibit creating fake accounts, and prohibit concealing or misrepresenting your identity in order to break those terms; the same page lets Google suspend or terminate your access, or delete the account, over a breach.

If you manage Gmail accounts for a team and a legitimate job needs more of them, ask PVAVRT on Telegram @pvavrt, or on WhatsApp +1 (310) 460-9890, which grade fits, then set up each account’s own backup codes and passkey on arrival. Bulk pricing is quoted per product on Telegram.