Recovery codes

Recovery codes are your safety net. If you turn on two-factor and then lose your phone, recovery codes get you back into your account.

When you get them

The moment you turn on two-factor, we show you ten recovery codes. They look like this: ABCD-EFGH-1234. Each one works once.

What to do with them

Save them somewhere safe and not on the same device that runs your authenticator app.

Good places:

• A password manager.
• A printed copy in a drawer at home.
• A note in your e-mail labeled "ShoutXChange recovery. Do not delete".

Bad places:

• The same phone that runs your authenticator app. If the phone breaks, the codes are gone too.
• A public note in your phone, where a thief who steals the phone can find them.

How to use one

1. Sign in with your email and password.
2. When asked for the six-digit code, click "I lost my phone".
3. Type one of your recovery codes.
4. You are in.

The code you used is now spent. You have nine left.

What if I run out?

You can make a new set of codes any time. Go to Settings, Security, and click Make new codes. The old codes stop working the moment you make new ones. Save the new ones and burn the old ones.

If you run out of codes and lose your phone, all is not lost. But you will have to prove who you are to our support team. We will ask for things like the email on the account, a recent invoice number, and the bank brand of the card on file. It takes a day or two. So please save the codes.

Why ten?

Ten is enough for normal use. Most people never need to use one. If you do need them, ten gives you a buffer for a few phone changes. If you start running low, make a fresh set.

Can I see my codes again later?

For safety, no. We do not store the codes in a place we can read. We only store a fingerprint of each code so we can check it when you type it in. If you lose them, you have to make new ones.

This is how every secure system handles recovery codes. We know it can feel strict. The reason is simple: if we could show them again, anyone who got into our system could see them too.