The problem I kept hitting
For years, the obvious place to put recovery codes was my password manager. That works until you look at the failure mode. If I lose access to the password manager, the codes meant to get me back into other accounts are out of reach too. If the vault is compromised, the recovery codes are exposed alongside the passwords they were supposed to help protect.
The better advice is to keep recovery codes somewhere separate, and ideally with more than one recovery path. But once you do that, a new problem appears: you have to remember which accounts have which backup codes, which authenticators are enrolled, and what has to be replaced when a phone or security key changes.
For one account, that is fine. For twenty or more services, a spreadsheet stops being a tool and starts becoming another thing you have to trust.
By that point, storing recovery codes was not really the job anymore. What I wanted was an inventory of accounts, authenticators, and recovery codes, so I could see what protected what and what needed attention before I was locked out. RecoveryCodes is what I built so I would stop improvising.
Who is behind it
RecoveryCodes is a one-person project. I have spent the last decade as an API security consultant in Germany, auditing authentication and authorization for B2B SaaS teams. The work is usually about one question: when access matters, can you prove who should have it, who actually has it, and what happens when something breaks?
I kept seeing capable teams handle the first part carefully and leave the recovery path to memory, spreadsheets, and hope. RecoveryCodes is the tool I wish those teams already had.
Principles
Recovery material is sensitive access.
Recovery codes can bypass MFA. Authenticator assignments show which devices can unlock which accounts. Both are treated as security critical: encrypted at rest, gated by step-up authentication, audit logged, and kept away from analytics.
Independent and operated from the EU.
No investors, no growth team, no data resale. The product is hosted in the EU and
run from Germany, so GDPR is the baseline rather than a feature I have to bolt on.
The .eu in the name is deliberate.
I am customer number one.
My own recovery codes live in RecoveryCodes. Every change I ship lands in my own vault before it lands in yours. If something feels wrong to use, I notice the same day you would.
Get in touch
If RecoveryCodes solves a problem you have also been working around, the best next step is to pick a plan and get your codes off whatever sticky note they are on today. If you have questions before that, write to me directly.