It seems pretty common for websites to issue a bunch of backup codes for MFA that the user saves somewhere.

Instead, why don't they provide the user with the private key for a digital signature and store the public key? Wouldn't the randomness for a digital signature be far more superior than 5x 6 digit codes?

  • Why would they? What's the benefit? How does the user or service invalidate a backup code? Backup codes are typically one-time-use. Keys are not. The key becomes an additional factor that would be valid at all times. If a service is going to use keys, why wouldn't they use that for MFA in the first place? Your original version says that backup codes are "usually" provided as a file, yet I have yet to see that process. What service uses a downloaded file instead of displayed codes on the screen?
    – schroeder
    Jan 13 at 10:29
  • 1
    Tech savvy users may choose to just store the TOTP secret as well. I have done this for many services.
    – vidarlo
    Jan 13 at 15:11

1 Answer 1


Recovery codes are easy for users to manage. They can store them in a password vault, write them down, print them out and stick them in a safe, etc. And they're easy to use - you just type them into the application.

A private key is certainly stronger, but it's also harder for users to store and manage, and much less practical to store a hard copy of. It's also harder to use - you don't want them to upload it, but asking them to sign something is adding a new level of complexity for the end user.

If you've got robust protections for how the recovery codes are used (throttling, lockout, etc) then the difference in the entropy of the codes vs a private key should be negligible - so there's not really much benefit of it over codes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .