TwoFactorBackupCode

Stores emergency backup codes that users can use to access their account when their primary two-factor authentication method is unavailable. These are typically 8-10 digit codes generated when 2FA is first enabled, and users are instructed to print or save them somewhere safe. Each code can only be used once - after being used, it's permanently invalidated to prevent reuse. Backup codes are the safety net for 2FA, preventing users from being permanently locked out if they lose their phone, authenticator app breaks, or hardware key is damaged. They're particularly critical for traveling users who might not have SMS access, or during phone number changes. The system typically generates 10-20 codes at once, and users can regenerate a new set if they run low. Each code is stored as a hash for security, and the system tracks which codes have been used, when, and from what IP address. This helps detect if backup codes have been compromised. Some systems alert users when backup codes are running low or have been used, as usage often indicates the primary 2FA method has failed.