On this page
Quick answer
To get a user back in, a Google Workspace administrator opens the Admin console, goes to Directory, then Users, opens the user, and under Security chooses 2-Step Verification and Get backup verification codes. The admin shares one 8-digit code with the user, who enters it at sign-in instead of the usual second step. Each code works once.
Who can generate backup codes for a user?
An administrator with the User management privilege can get backup codes for ordinary users. If the locked-out account is itself an administrator, only a super administrator can generate its codes.
Users can normally create their own backup codes from their Google Account. When 2-Step Verification is enforced as Only security key, they cannot, so an administrator has to provide the codes.
How does an admin get backup codes for a user?
- Step 1
Sign in to the Admin console
Go to admin.google.com and sign in with your administrator account.
Screenshot to come · Step 1: Sign in to the Admin console - Step 2
Open Directory, then Users
In the Admin console, go to Menu, then Directory, then Users.
Screenshot to come · Step 2: Open Directory, then Users - Step 3
Open the user's account
Find the user in the list (search by name or email) and click their name.
Screenshot to come · Step 3: Open the user's account - Step 4
Open Security
On the user's page, click Security to open their sign-in and 2-Step Verification settings.
Screenshot to come · Step 4: Open Security - Step 5
Choose 2-Step Verification
Open the 2-Step Verification panel, then click Get backup verification codes.
Screenshot to come · Step 5: Choose 2-Step Verification - Step 6
Copy a code or generate new ones
Copy one of the existing codes. Click Generate new codes if the old codes may have been seen by someone else or are used up; the old set stops working straight away.
Screenshot to come · Step 6: Copy a code or generate new ones - Step 7
Give the user one code
Share a single code by phone or in person, not by email to the mailbox they cannot open.
Screenshot to come · Step 7: Give the user one code
How does the user sign in with a backup code?
- Step 1
Sign in as usual
Go to mail.google.com or accounts.google.com and enter the work email address and password.
Screenshot to come · Step 1: Sign in as usual - Step 2
Choose to enter a backup code
When Google asks for the second step, choose Try another way and pick the option to enter one of your backup codes.
Screenshot to come · Step 2: Choose to enter a backup code - Step 3
Enter the code from your admin
Type the 8-digit code without spaces. It stops working once used.
Screenshot to come · Step 3: Enter the code from your admin - Step 4
Set up 2-Step Verification again
Once signed in, open your Google Account, go to Security, then 2-Step Verification, and add a new phone or security key, so you are not locked out next time.
Screenshot to come · Step 4: Set up 2-Step Verification again
What should you watch out for?
Warning
New codes cancel the old ones
Generate new codes replaces the whole set. Any code you already gave the user stops working, so send them a fresh one.
Good to know
Share one code, not the set
Google issues backup codes in sets of 10. Give the user one at a time and keep the rest out of email and chat.
Good to know
Use a trusted channel
Confirm who you are talking to before you read out a code. A backup code is a key to the account.
Good to know
Admin accounts need a super administrator
A delegated admin with User management cannot generate codes for another admin account.
Tip
Check enforcement first
If the user's organisational unit enforces Only security key, they cannot make their own codes later. Plan to issue codes for them again if they lose a key.
Was this article helpful?
Frequently asked questions
How many backup codes does Google give, and how long do they last?
Google issues backup codes in sets of 10. Each code works once and then becomes inactive. Unused codes keep working until someone generates a new set, which cancels the old one. An admin can copy an existing code from the user's 2-Step Verification panel or generate a fresh set at any time.
Can a user get backup codes without an admin?
Yes, in most cases. A signed-in user can create their own backup codes from their Google Account under Security and 2-Step Verification. They need an administrator only when they are already locked out, or when the organisation enforces Only security key, which stops users from generating codes themselves.
Why can't I generate codes for another administrator?
Google limits this to super administrators. An admin with the User management privilege can get backup codes for ordinary users, but not for another admin account. Ask a super administrator in your organisation to do it, or raise a ticket with Gulf Infotech if we manage your Google Workspace.