Recovery Code Generator
Generates a grouped alphanumeric code with ambiguous characters removed, in the style used for account-recovery backup codes. Generated locally in your browser using the Web Crypto API. It is never sent to a server, never logged, and never included in analytics.
What this generator does
Produces one backup code per press, of the kind services issue for account recovery when two-factor authentication is unavailable. Services usually issue eight to ten at a time; for a set, generate and copy that many times.
How to use this tool
- Press generate to create a new recovery code.
- Copy and store it somewhere safe — this tool does not save it for you.
Worked examples
- The default shape
- 4 groups of 4 characters, e.g. XK7M-9RTQ-2VWN-B4PH — 16 characters drawn from a 32-symbol alphabet, for 80 bits of entropy.
Common use cases
- Creating a placeholder backup code for documentation or testing
- Generating a one-off access code
- Any use case needing a short, easy-to-transcribe code
How this generator works
Each character is drawn independently and uniformly from a fixed 32-character alphabet using your browser's Web Crypto random generator. That alphabet is the 26 letters and 10 digits with I, O, 0 and 1 removed, because those are the pairs people most often misread on a printed code — leaving 24 letters and 8 digits, 32 symbols exactly, which is why each character carries precisely 5 bits of entropy (32 = 2^5) rather than an awkward fraction. A default code of 4 groups of 4 characters is 16 characters, or 80 bits.
Randomness and fairness
Every character comes from your browser's cryptographic random generator, drawn uniformly from the 32-character alphabet with no seed and no reproducible mode.
For how randomness is produced across the whole site, see how Generate Random works.
Limitations and good to know
- These are codes in the right shape, not codes registered with any service. They will not unlock a real account — use the codes your provider issues.
- Nothing here tracks which codes have been used. A real recovery-code system marks each one single-use and this does not model that at all.
Privacy and your data
Codes are produced in your browser and never sent anywhere. Nothing is stored, so closing the tab is enough to remove them — copy them somewhere safe before you do.
Frequently asked questions
- Why are some letters and digits missing from the code?
- I, O, 0 and 1 are deliberately excluded because they are the characters people most often misread or mistype from a printed or handwritten code — the letter I for the digit 1, the letter O for a zero. The remaining 32-character alphabet still gives a clean 5 bits of entropy per character.
- Can I use these to recover a real account?
- No. These are examples in the correct format, generated independently of any service. Only the codes a provider actually issues and registers against your account will work for recovery.
Related generators
- UUID GeneratorAn RFC 4122 v4 UUID for development or testing use — cryptographically random, not sequential.
- PIN GeneratorA numeric PIN between 4 and 12 digits — for testing PIN-entry flows or examples, not a real account credential.
- Bulk Password GeneratorGenerate many independent passwords at once, for provisioning multiple accounts.
- Security Question GeneratorAn example security-question prompt idea — not a real answer or account data.
- TOTP Drift & Code Window CalculatorHow many authenticator codes are valid at once, and exactly what widening the window to forgive clock drift costs.