What a recovery key is, and where to keep it
Your recovery key is a 26-character code Never Lose Codes shows you once, during setup. It opens your encrypted codes and backup files on any computer. Keep it safe and you can't be locked out of your codes.
What it opens
- Every backup file. Backups in Downloads/NeverLoseCodes are encrypted so that only the recovery key opens them. That's what lets you restore on a new computer.
- Your codes after Chrome forgets its key. Normally Chrome holds a key that opens your codes without typing anything. If that's wiped, for example by clearing browsing data, the recovery key opens them.
- Your codes if you forget your app password. If you set an optional app password and forget it, the recovery key opens your codes instead. You can then set a new password.
Why nobody can reset it for you
Never Lose Codes has no account and no server holding your codes. That's what keeps them private: there's no copy anywhere that anyone else could leak or be forced to hand over. The other side of that is there's also no "forgot my key" email. If your key and every working copy of the app are gone, the backups stay locked, for us too.
How strong it is
The key is 26 characters chosen at random from 31 letters and numbers, which is about 128 bits of randomness. Guessing it isn't practical. Easily confused characters (0, O, 1, I and L) are left out so it's easy to copy by hand. It's shown in groups, like ABCD-EFGH-…; dashes and spaces don't matter when you type it.
Recovery key, app password, backup codes: what's the difference?
| Thing | Who makes it | What it does |
|---|---|---|
| Recovery key | Never Lose Codes, once at setup | Opens your encrypted codes and every backup file, on any computer. |
| App password | You, optional | Locks your codes on this computer so someone at your keyboard can't open them. Doesn't open backup files. |
| Sites' backup codes | Each website, when you turn on 2FA | Get you into that one site without any authenticator. Each code works once. |
You want all three saved: the recovery key protects your whole authenticator, and each site's backup codes protect that site even if every authenticator is gone.
Where to keep it
Pick at least one of these, ideally two:
- Your password manager, as a secure note.
- Printed or written on paper, stored with your important papers.
- The file Never Lose Codes offers to save during setup, moved to a USB stick or another place you trust, not left next to your backups.
Avoid keeping it in the same folder as your backup files, in plain email, or only on the computer your codes are on. A backup file plus its key together is everything someone needs.
Setup makes you confirm it
When you set up, Never Lose Codes shows the key and asks you to type its last 4 characters to confirm you saved it. The Shield page shows a green check for "Recovery key saved" once you've done that.
Lost it? Make a new one now, while you still can
If your codes still open on your computer, go to Settings → Make a new recovery key. Save the new key right away. From then on, new backups use the new key. Older backup files were sealed with the old key and still need it, so if you find the old key later, keep it.
After making a new key, go to Shield and click Back up now so a backup sealed with the new key exists immediately.
Test it
A key you've never used is a key you're hoping works. Do a quick restore into a second Chrome profile with your newest backup file and your key. How to back up your 2FA codes walks through it.
Never Lose Codes is a Chrome extension that keeps your 2FA codes encrypted on your computer, with backup files you hold and a recovery key. See how it works.