Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device.

Are these used only to log into Google, or can they be used to log into other sites?

share|improve this question
up vote 3 down vote accepted

It depends.

If you're using a site that uses Sign in with Google+ (or whatever): yes. It's the exact same authentication endpoint so signin works the same way.

If you had to set up a separate account (only applies to the 2-step verification app): no. An example of this would be Dropbox.

share|improve this answer

The backup codes provided by Google will only work for Google's services.

The Google Authenticator works on the standard HOTP and TOTP algorithms described in their RFCs. Google just provided a convenient app to use it. HOTP and TOTP are relatively easy to implement algorithms and most popular languages has libraries supporting it. In fact, here is one I wrote for .NET.

It is up to each individual site implementing the HOTP or TOTP algorithms through Google Authenticator to provide a means to recover from the loss of said Authenticator.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.