[{"data":1,"prerenderedAt":195},["ShallowReactive",2],{"blog-/en/blog/how-to-share-2fa-recovery-codes-securely":3},{"id":4,"title":5,"alternate_path":6,"author":7,"body":8,"date":184,"description":185,"draft":186,"extension":187,"locale":188,"meta":189,"navigation":190,"path":191,"seo":192,"stem":193,"__hash__":194},"blog/blog/how-to-share-2fa-recovery-codes-securely.md","Share 2FA recovery codes without leaving them in chat history","/blog/partager-codes-recuperation-2fa","Rémy Sainsard",{"type":9,"value":10,"toc":176},"minimark",[11,23,30,35,53,70,77,81,115,122,130,134,145,149,165,168],[12,13,14,18,19,22],"p",{},[15,16,17],"strong",{},"Recovery codes"," (2FA backup codes) let you sign in when your authenticator app or SMS is unavailable. They are ",[15,20,21],{},"limited-use secrets",": once exposed or consumed, you should regenerate them.",[12,24,25,26,29],{},"Teams still paste them in plain text in a Teams thread, a ticket, or an email “so someone can log in once”. The channel ",[15,27,28],{},"keeps"," that text long after the incident is over.",[31,32,34],"h2",{"id":33},"why-that-is-risky","Why that is risky",[12,36,37,38,43,44,48,49,52],{},"Like a ",[39,40,42],"a",{"href":41},"/en/blog/how-to-share-a-password-securely","password"," or an ",[39,45,47],{"href":46},"/en/blog/how-to-share-an-api-key-securely","API key",", Slack, WhatsApp, and Gmail retain a ",[15,50,51],{},"searchable copy",":",[54,55,56,60,63],"ul",{},[57,58,59],"li",{},"admin access or exports can surface the conversation later;",[57,61,62],{},"a screenshot or thread search can leak codes months later;",[57,64,65,66,69],{},"regenerating codes at the provider does ",[15,67,68],{},"not"," delete the chat message.",[12,71,72,73,76],{},"An unused recovery code often stays ",[15,74,75],{},"valid until you revoke it"," — like leaving a spare key under the mat.",[31,78,80],{"id":79},"better-habit-secret-once-link-in-chat","Better habit: secret once, link in chat",[82,83,84,98,105,112],"ol",{},[57,85,86,87,93,94,97],{},"Paste the code list (or a single code) on ",[39,88,92],{"href":89,"rel":90},"https://secretshare.eu",[91],"nofollow","secretshare.eu"," — encrypted ",[15,95,96],{},"in the browser","; the server never sees plaintext.",[57,99,100,101,104],{},"Send ",[15,102,103],{},"only"," the generated link on your usual channel.",[57,106,107,108,111],{},"The recipient reads, stores in a password manager, and the link ",[15,109,110],{},"stops working"," after one view.",[57,113,114],{},"Regenerate remaining codes at the provider if you suspect a leak.",[12,116,117,118,121],{},"Never paste the codes ",[15,119,120],{},"next to"," the link in the same message — that puts a permanent copy back in the chat.",[12,123,124,125,129],{},"Same idea as a ",[39,126,128],{"href":127},"/en/blog/self-destructing-message","self-destructing message",": one read, then gone on Secret Share’s side.",[31,131,133],{"id":132},"typical-use-cases","Typical use cases",[54,135,136,139,142],{},[57,137,138],{},"IT onboarding: hand over backup codes until the authenticator is set up;",[57,140,141],{},"internal support: temporary access to a tool account (with rotation afterward);",[57,143,144],{},"contractor: one-time code instead of a PDF of codes in a project channel.",[31,146,148],{"id":147},"what-secret-share-does-not-replace","What Secret Share does not replace",[12,150,151,152,155,156,159,160,164],{},"Secret Share ",[15,153,154],{},"delivers"," the secret; it does not replace ",[15,157,158],{},"2FA policy"," (mandatory MFA, team vaults, rotation). For how the product works, see ",[39,161,163],{"href":162},"/en/blog/what-is-secret-share","what Secret Share is",".",[166,167],"hr",{},[12,169,170,171,164],{},"Try it at ",[15,172,173],{},[39,174,92],{"href":89,"rel":175},[91],{"title":177,"searchDepth":178,"depth":178,"links":179},"",2,[180,181,182,183],{"id":33,"depth":178,"text":34},{"id":79,"depth":178,"text":80},{"id":132,"depth":178,"text":133},{"id":147,"depth":178,"text":148},"2026-10-27","Backup codes and account recovery: why not to paste them in Slack or email, and how a one-time link helps.",false,"md","en",{},true,"/blog/how-to-share-2fa-recovery-codes-securely",{"title":5,"description":185},"blog/how-to-share-2fa-recovery-codes-securely","YhcPaaV_NZOc7mA3XSS0wvYJNoZckYH-XYBqlmGj29g",1793087691547]