Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238.

It works fine with Google Authenticator, which is great.

Now I am turning my attention to the backup codes, that are provided by services implementing 2FA such as Google and GitHub.

I notice they are of a different length and/or format to the usual 6 digit direct authentication code.

So, do I:

  • Generate an arbitrary number of codes when a user sets up 2FA
  • Store them in the DB alongside the user
  • Make use of the fact they are a different length or format in order to decide how to check them?

Are they supposed to be random, or generated based on some hash of the user?

share|improve this question
Because Google can regenerate new codes for you on command, one would think they're randomly generated. – eric_lagergren Jul 7 '14 at 19:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.