Use recovery codes

Recovery codes are your spare keys. You get ten of them when you turn on two-step verification or add your first passkey, and each one stands in for a code or passkey once. How they fit with the other methods is on Sign-in security.

Before you start

You have recovery codes only once two-step verification is on, with an authenticator app, email codes or a passkey. They are shown once: at the end of turning it on, after your first passkey, and each time you generate a new set.

Steps

Save them when they are shown

1. On the Save recovery codes step, select Copy or Download .txt.
2. Keep them somewhere safe and away from your password: a password manager, or a printed copy in a drawer at home.
3. Tick I have saved these codes and select Done.

Sign in with one

1. Sign in with your password as usual.
2. On the Two-step verification step, select Use a recovery code instead.
3. Enter one of your codes in Recovery code and select Verify. Dashes, spaces and capital letters do not matter. Cross it off your list. easySales emails you that a recovery code was used, and how many are left.

Generate a new set

1. On My profile, Sign-in & security, select Generate new codes under Two-step verification. If your only method is a passkey, the button is on the Passkeys card.
2. In Generate new recovery codes, select Generate (on the Passkeys card the button reads Generate new codes). If easySales asks, complete Confirm it’s you with a code from your authenticator app or email, your passkey, or one of your old recovery codes.
3. Save the new codes as above.

What happens next

The card shows Recovery codes: N of 10 left, and the count is highlighted as a warning when two or fewer are left. After Generate new codes, your old codes stop working at once, used or not, and easySales emails you that a new set was made.

Rules to know

Rule	Detail
Codes per set	10
Each code works	Once
A new set	Replaces the whole old set
Generating a new set	Asks you to confirm it’s you
Turning two-step verification off, or removing your last passkey	Ends every code
Your administrator resetting your 2FA	Ends every code

• A recovery code stands in for a code or passkey in three places: the second step at sign-in, Confirm it’s you, and approving an AI app. Each use spends that code. At sign-in you still type your password first.
• Down to your last few? Generate a new set now, while you can still sign in.
• If you have no codes left and no other method, see Get back in.

Why it works this way

A key that needs no device. Phones are lost, broken and replaced; a printed sheet or a password manager entry is not. Recovery codes let you in when every device is gone, without asking anyone to switch your security off.

Shown once, kept unreadable. easySales keeps only a scrambled form of each code that cannot be turned back into the code. Nobody, at your company or at easySales, can look your codes up later, which is why you save them the moment they appear.

Each code works once, and a sign-in with one is announced. A code someone else saw is spent the moment you use it, and the email after each recovery-code sign-in tells you at once if someone else signed in with one of your codes.

A new set cancels the old one. If a list may have been seen, generating a new set ends every old code at once, used or not.

Work faster

• Download the file straight into your password manager. Download .txt saves easysales-recovery-codes.txt; attach it to your easySales entry rather than leaving it in Downloads. See Use an authenticator app.
• Watch the count. Recovery codes: N of 10 left turns to a warning at two or fewer; generate a new set then, while you can still sign in.
• Use a passkey instead of spending a code. A passkey on a second device does the same job and is never used up. See Set up a passkey.
• Type the code as it comes. Dashes, spaces and lower-case letters are accepted, so there is no need to tidy a code copied from the file. See Sign in.

Examples

Down to two codes. Daniel Lim has used eight recovery codes while his phone was being repaired, so the card reads Recovery codes: 2 of 10 left as a warning (10 − 8 = 2). He selects Generate new codes, confirms it’s him with a code from his repaired phone, and saves ten new codes. The two unused old codes stop working at once.

One code, three uses. Farah’s phone is away for repair, so she works from her printed sheet. On Monday she signs in with code 1, on Tuesday she confirms it’s her with code 2 before creating a personal token, and on Wednesday she approves an AI app with code 3. Monday’s sign-in emails her that a recovery code was used, and the card then reads Recovery codes: 7 of 10 left (10 − 3).

Common questions

• What are recovery codes? Ten single-use codes you save when you turn on two-step verification or add your first passkey. Each one stands in for your code or passkey once.
• Where can I see my recovery codes again? You cannot. They are shown once; if you lost them, select Generate new codes to get a new set.
• Where should I keep recovery codes? Somewhere safe and away from your password: a password manager, or a printed copy at home.
• Do recovery codes expire? No. Each works until it is used, or until you generate a new set or two-step verification is turned off or reset.
• I have used all my recovery codes. What now? If you can still sign in with your app, email codes or a passkey, generate a new set. If not, ask your administrator; see Get back in.
• Can I sign in with a recovery code instead of my password? No. A recovery code replaces the second step only; you type your password first.

Related

• Sign-in security
• Get back in
• Confirm it’s you