Google Workspace accounts often contain important business information, including Gmail messages, Google Drive files, calendars, contacts, shared documents, and administrative resources. Protecting these accounts with 2-Step Verification (2SV) significantly improves account security.

However, 2-Step Verification can create an access problem when your normal verification method is unavailable. For example, your phone may be lost, damaged, replaced, or temporarily inaccessible.

This is one of the situations where Google backup codes can help.

Backup codes are emergency sign-in codes associated with your Google Account. When available and configured, they can be used as an alternative second verification step.

This article explains where Google Workspace users can find backup codes, how to generate and store them, how they work, what happens after a code is used, and what administrators should consider when protecting business accounts.

What Are Google Backup Codes?

Google backup codes are emergency codes that can be used as a second verification step when you cannot use your usual 2-Step Verification method.

For example, suppose you normally sign in using:

Email address + Password + Google Prompt

but your phone is unavailable.

You may instead be able to sign in using:

Email address + Password + Backup Code

Backup codes are therefore best viewed as an emergency alternative to your normal second factor, not as a replacement for your account password.

Google currently generates a set of 10 backup codes, and each code is 8 digits long.

Each backup code can be used only once.

Where Can I Find Google Backup Codes?

For a Google Workspace account, backup codes are generally managed through the individual user's Google Account security settings, rather than through Gmail itself.

The normal path is:

Google Account → Security & sign-in → How you sign in to Google → 2-Step Verification → Backup codes

You may be required to authenticate again before Google displays or lets you manage this security information.

Google's current instructions provide options to generate, refresh, delete, download, and print backup codes.

Official Google instructions:

Google Account Help – Sign in with backup codes

How to Generate Google Backup Codes on a Computer

Sign in to the Google Workspace account for which you want to create backup codes.

Open your Google Account settings.

Select:

Security & sign-in

Find:

How you sign in to Google

Then select:

2-Step Verification

You may need to enter your password or complete another identity-verification step.

Locate:

Backup codes

Select Continue if prompted.

If backup codes have not yet been generated, choose the option to get backup codes.

Google generates a set of emergency codes that you can securely store.

What Can You Do from the Backup Codes Section?

Depending on your account configuration and Google's current interface, the Backup Codes section can provide several management options.

You can generate backup codes if none currently exist.

You can download the codes for secure offline storage.

You can print the codes.

You can delete the existing backup codes.

You can also generate a new set, which invalidates the previous set.

This last point is particularly important for security.

If you believe somebody has obtained a copy of your backup codes, generate a new set immediately. The old codes will no longer work.

How Many Google Backup Codes Do You Get?

Google currently provides a set of 10 backup codes.

Each code is intended for one-time use.

For example:

Backup Code 1 → Used → No longer valid
Backup Code 2 → Available
Backup Code 3 → Available
...

Once a code has successfully been used for sign-in, it cannot be reused.

This protects the account if an old code is later discovered by someone else.

What Does a Backup Code Look Like?

Google backup codes are 8-digit codes.

For example, a backup code could conceptually look like:

1234 5678

The example above is not a real backup code.

Never publish, email, message, or otherwise expose your actual backup codes.

Treat them with similar care to account credentials.

How to Download Google Backup Codes

From:

Google Account → Security & sign-in → 2-Step Verification → Backup codes

choose the option to download the codes.

Google's documentation says that if you previously downloaded your backup codes, you can search your computer for a filename in the following pattern:

Backup-codes-username.txt

Replace username with the relevant account username.

For example:

Backup-codes-exampleuser.txt

This can be useful when you remember downloading the codes previously but cannot remember where you saved the file.

Security Warning

Do not casually leave this text file in:

Desktop
Downloads
Documents
Shared folders
Public folders
Unencrypted USB drives
Shared network drives

Anyone who obtains both your account credentials and an unused backup code could potentially use them during authentication.

For business-critical accounts, especially administrator accounts, backup codes should be stored using an organization-approved secure method.

How to Print Google Backup Codes

Google also allows backup codes to be printed.

Open:

Google Account → Security & sign-in → 2-Step Verification → Backup codes

and select the print option.

A printed copy can be useful because it does not depend on the phone or computer you normally use for authentication.

However, physical copies must also be protected.

For an administrator account, consider storing the emergency copy in a physically secure location accessible only to authorized personnel.

How to Use a Google Backup Code

Suppose your phone is lost and Google asks for your second verification step.

Enter your Google Workspace email address and password as usual.

When Google requests verification, select:

Try another way

Look for an option similar to:

Enter one of your 8-digit backup codes

Enter one unused backup code.

If the code is valid, it can satisfy the second verification step.

After successful use, that particular backup code becomes inactive.

Google's official instructions confirm that each backup code can be used only once.

Example: Your Phone Is Lost

Consider an employee using:

employee@example.com

The employee knows the account password, but their phone is lost.

Normally, Google sends a prompt to that phone.

Instead, the user may select:

Try another way → Enter one of your 8-digit backup codes

The user retrieves a previously stored backup code and enters it.

After regaining access, the user should review the account's security settings and configure appropriate verification methods on the replacement device.

If the phone was stolen, additional security actions such as signing the lost device out and changing the Google Account password may also be appropriate.

What Happens After You Use a Backup Code?

The backup code becomes invalid.

Suppose you have:

Code A
Code B
Code C
Code D

and use Code B.

Code B cannot be used again.

The remaining unused codes can continue to be available.

A good practice is to clearly mark printed codes as used without exposing or unnecessarily copying the remaining codes.

Can I Generate New Backup Codes?

Yes.

You can generate a new set of backup codes through your Google Account's 2-Step Verification settings.

There is an important consequence:

Generating a new set invalidates the previous set.

Therefore, after creating new backup codes, destroy outdated printed copies and securely delete obsolete digital copies.

Do not assume an old unused code will continue to work after a new set has been generated.

What If My Backup Codes Are Lost or Stolen?

Do not continue relying on them.

If you can still access your Google Account, open:

Security & sign-in → 2-Step Verification → Backup codes

and generate a new set.

The previous backup codes will become inactive.

Then securely store the new set.

This is useful if:

• You misplaced a printed copy.
• A USB drive containing the codes was lost.
• The backup-code file was accidentally shared.
• An employee with access to emergency credentials left the organization.
• You are uncertain whether someone copied the codes.

Are Google Workspace Backup Codes Different from Gmail Backup Codes?

The underlying concept is the same because authentication occurs through the Google Account.

A consumer Gmail account might be:

person@gmail.com

A Google Workspace account might be:

person@company.com

Both can use Google Account security mechanisms, subject to the organization's policies and account configuration.

The main difference with Google Workspace is that an administrator may enforce security policies that affect available authentication methods.

Can a Google Workspace Administrator See a User's Backup Codes?

Organizations should not treat backup codes as something administrators routinely collect from users.

Backup codes are authentication credentials associated with the user's account.

Administrators have separate administrative recovery and account-management capabilities.

The correct approach is to manage account access through authorized Google Workspace administration procedures rather than asking users to disclose their personal backup codes.

What If the Backup Codes Option Is Missing?

Several possibilities should be considered.

First, verify that 2-Step Verification is enabled. Google states that backup codes require 2-Step Verification to be turned on.

Second, your Google Workspace administrator may have configured authentication policies that affect the methods available to your account.

Third, certain high-security configurations can work differently. For example, Google states that users enrolled in the Advanced Protection Program cannot download backup codes.

Google's interface and available security methods can also change, so administrators should verify the current policy applying to the affected organizational unit or group.

What If I Cannot Sign In to View My Backup Codes?

This distinction is critical.

Backup codes are most useful when they are generated and stored before an emergency happens.

If your phone is already lost and you cannot pass 2-Step Verification, you may not be able to simply open the account settings and generate backup codes.

At the sign-in screen, select:

Try another way

Google may offer another previously configured verification method, such as another signed-in device, backup phone number, security key, passkey, or previously generated backup code.

For a work or school Google Workspace account, Google also recommends contacting your administrator when normal sign-in methods are unavailable.

Backup Codes Are Not the Same as Google Authenticator Codes

These two types of codes are often confused.

Google Authenticator code

An authenticator application generates changing verification codes.

These codes are designed to expire quickly and new codes are continually generated.

Google backup code

A backup code is generated beforehand and stored for emergency use.

It does not continually change like an authenticator-generated code.

Once a backup code is used, it becomes invalid.

Therefore:

Authenticator code = regularly changing authentication code

Backup code = stored, one-time emergency code

Backup Codes Are Not Recovery Codes Sent by SMS

Backup codes should also not be confused with verification codes delivered by text message.

An SMS verification code is sent to a configured phone number during authentication.

A backup code has already been generated and stored beforehand.

This makes backup codes useful in situations where the phone itself is unavailable.

Should Google Workspace Administrators Generate Backup Codes?

Administrators should prepare emergency authentication methods before they are needed.

This is particularly important for super administrator accounts, because loss of access to a super admin account can affect the organization's ability to manage users, security policies, billing, applications, and other administrative functions.

Google's administrator security guidance recommends saving backup codes ahead of time and keeping them in a secure location. Google also recommends strong 2-Step Verification protection for administrator accounts.

Official guidance:

Google administrator account security best practices

Recommended Emergency Setup for a Google Workspace Super Admin

Do not depend on a single phone as the only way to authenticate a critical administrator account.

A stronger recovery strategy can include:

Primary authentication method

A passkey or other organization-approved strong authentication method.

Additional authentication method

A separately controlled security key or other supported verification method.

Emergency backup

Securely stored backup codes, where supported.

Organizational resilience

Maintain appropriate additional super administrator access so that the organization is not completely dependent on one person's device.

The exact design should reflect the organization's security requirements.

Where Should Backup Codes Be Stored?

The purpose of backup codes is emergency access, so storing them only on the same phone used for 2-Step Verification defeats much of their value.

For example:

Phone contains Google Authenticator
+
Screenshot of backup codes stored on same phone
+
Phone is lost
=
Both authentication methods may be lost together

Instead, separate the backup mechanism from the primary authentication device.

Possible secure approaches include an approved password manager, encrypted storage, a secured offline copy, or a protected physical copy.

For critical administrator accounts, organizations should document who is authorized to access emergency credentials and under what circumstances.

Should I Take a Screenshot of My Backup Codes?

It is technically possible, but it is generally not the best storage method.

Screenshots may automatically synchronize to:

• Cloud photo services
• Device backups
• Shared photo libraries
• Other signed-in devices

That can increase the number of locations containing sensitive authentication information.

A secure password manager, protected offline storage, or securely stored printed copy is usually preferable.

Can Backup Codes Be Used Without the Password?

Normally, no.

Backup codes are intended to serve as the second verification step.

The normal authentication flow remains:

Username
+
Password
+
Second verification

The backup code substitutes for an unavailable second verification method; it does not normally replace the account password itself.

Can the Same Backup Code Be Used Twice?

No.

Once a backup code is successfully used, it becomes inactive.

Use another unused code for a future emergency.

What Happens When I Generate a New Set?

The previous set becomes invalid.

This is useful when the previous codes have been:

• Lost
• Stolen
• Accidentally shared
• Stored insecurely
• Potentially copied

Generate a new set and securely replace the old copies.

What If I Lose My Phone and Have No Backup Codes?

At Google's verification screen, select Try another way.

Depending on what was configured previously, Google may offer another signed-in device, backup phone, security key, passkey, or another supported verification method.

Google lists several alternative verification options for users who lose access to their primary phone.

For a Google Workspace account, contact your organization's administrator if you cannot sign in.

Official troubleshooting guidance:

Google 2-Step Verification troubleshooting

Backup Codes and the Advanced Protection Program

There is an important exception.

Google states that users enrolled in the Advanced Protection Program cannot download backup codes.

Organizations using Advanced Protection or other high-security authentication configurations should therefore design their recovery process around the authentication and recovery mechanisms supported by those policies.

Do not assume backup codes will always be available for every Google account.

Security Checklist for Google Workspace Users

Before you need emergency account recovery, verify that:

• 2-Step Verification is properly configured.
• Your primary authentication method works.
• Appropriate backup authentication methods are configured.
• Backup codes are generated where available.
• Backup codes are stored separately from your primary phone.
• Old backup-code sets have been securely destroyed.
• Recovery information is current where applicable.
• Lost or stolen devices are promptly removed from the account.
• Administrators have documented recovery procedures for critical accounts.

For super administrators, emergency access planning should be treated as part of the organization's security policy rather than an individual convenience.

Frequently Asked Questions

1. Where do I find Google backup codes?

Open your Google Account and navigate to:

Security & sign-in → How you sign in to Google → 2-Step Verification → Backup codes

You may need to authenticate again.

2. Are backup codes available for Google Workspace accounts?

They can be, depending on the account's security configuration and organizational policies.

3. How many Google backup codes are generated?

Google currently generates a set of 10 backup codes.

4. How many digits are in a Google backup code?

Google backup codes are 8-digit codes.

5. Can I use the same backup code multiple times?

No. Each code can be used only once.

6. What happens after I use a backup code?

That specific code becomes inactive.

7. Can I generate new backup codes?

Yes. Where the feature is available, you can generate a new set from your 2-Step Verification settings.

8. Will generating new codes disable the old ones?

Yes. When a new set is generated, the previous set becomes inactive.

9. Can I download my backup codes?

Yes, Google provides a download option where backup codes are supported.

10. Can I print backup codes?

Yes. Google provides a print option.

11. Where is my previously downloaded backup-code file?

Google recommends searching for a filename using this format:

Backup-codes-username.txt

12. Can backup codes replace my Google password?

No. They normally act as the second verification step, not as a replacement for your password.

13. Can I use a backup code when my phone is lost?

Yes, provided you generated and securely stored an unused backup code beforehand and the account supports that authentication method.

14. Do backup codes expire automatically?

The key practical issue is that a code becomes invalid after it is used, and an old set becomes invalid when you generate a new set. Google may also change account security behavior over time, so critical organizations should periodically review their recovery configuration.

15. What should I do if my backup codes are stolen?

Generate a new set as soon as possible. This invalidates the previous set.

16. Can my Google Workspace administrator give me my existing backup codes?

Do not depend on an administrator having a copy of your existing codes. Contact your administrator for the organization's authorized account-access or 2-Step Verification recovery procedure.

17. What if I don't see Backup codes under 2-Step Verification?

Check whether 2-Step Verification is enabled and whether your organization's security policies permit that verification method.

18. Are backup codes the same as Google Authenticator codes?

No. Authenticator codes change regularly. Backup codes are stored emergency codes that become invalid after use.

19. Are backup codes the same as SMS verification codes?

No. SMS codes are delivered to your phone during authentication. Backup codes are generated beforehand and stored for emergencies.

20. Should super administrators keep backup codes?

Where backup codes are supported, emergency codes can be part of a broader administrator recovery plan. Critical administrator access should not depend solely on one phone or one verification mechanism.

21. Can I store backup codes on my phone?

You can, but storing the only copy on the same phone used for authentication creates a single point of failure.

22. Can I screenshot backup codes?

It is possible, but screenshots may be synchronized or backed up automatically. Secure credential storage is preferable.

23. Can backup codes help if my SIM card stops working?

Yes. A previously generated backup code can provide a second verification method without relying on SMS.

24. Can backup codes help when Google Authenticator is unavailable?

Yes, when backup codes were generated beforehand and remain valid.

25. What should I do immediately after using an emergency backup code?

Review your account security, restore reliable authentication methods, remove lost devices where appropriate, and verify that sufficient unused emergency methods remain available.

Conclusion

Google backup codes are an important emergency-access feature for accounts protected by 2-Step Verification.

For a typical Google Workspace user, look under:

Google Account → Security & sign-in → 2-Step Verification → Backup codes

Generate the codes before an emergency, store them securely away from your primary authentication device, and remember that each code can be used only once.

For Google Workspace administrators—especially super administrators—backup codes should be only one component of a broader recovery strategy. Critical administrative access should have multiple secure authentication and recovery options so that losing one phone does not create an organization-wide access problem.

 

#GoogleWorkspace #GoogleBackupCodes #BackupCodes #Google2FA #Google2SV #TwoFactorAuthentication #TwoStepVerification #GoogleSecurity #WorkspaceSecurity #GoogleAccount #GoogleAccountSecurity #AccountSecurity #CyberSecurity #GoogleAdmin #WorkspaceAdmin #GoogleWorkspaceAdmin #SuperAdmin #GoogleSuperAdmin #AccountRecovery #GoogleRecovery #WorkspaceRecovery #GmailSecurity #Gmail #GoogleAuthenticator #Authenticator #LostPhone #PhoneRecovery #SecurityCodes #VerificationCode #BackupCode #EmergencyAccess #AccountProtection #BusinessSecurity #EmailSecurity #CloudSecurity #IdentitySecurity #Authentication #MultiFactorAuthentication #MFA #2FA #2SV #SecurityGuide #TechSupport #ITSupport #GoogleTips #WorkspaceTips #AdminSecurity #CyberSecurityTips #GoogleAccountRecovery #GoogleWorkspaceSecurity