May 13, 2026 — The last gap in our MFA story closes today. Losing every authenticator app and every passkey at once is how real users end up locked out of their own accounts. SyAuth now ships 10 single-use recovery codes per user as a break-glass path — printed, stored in a password manager, or taped inside a desk drawer.
Properties
- Ten codes per user, format
XXXXX-XXXXXusing an unambiguous alphabet (no zero/O, no one/I). - Stored SHA-256 hashed; the plaintext is returned once at generation time and is never recoverable thereafter.
- Single-use. Each successful verify marks the code consumed; replays fail immediately.
- Regenerating invalidates every existing code, used or not — for the "I lost my list, start over" case.
- Not a primary factor. Having only recovery codes does not enable MFA — the login gate still requires a TOTP or passkey first. Recovery is the fallback when the primary factor is unavailable, not a replacement for it.
Enrollment
In the SyAuth dashboard (/security/mfa), the new Recovery codes panel shows how many unused codes are left (badge turns yellow at ≤ 2) and a Generate / Regenerate button. The plaintext grid is shown exactly once, with a Copy all helper that drops newline-separated codes on the clipboard.
Using a recovery code
The MFA challenge at login accepts either a TOTP code or a recovery code in the same input field. The server tries TOTP first; on failure it falls back to recovery verification. Successful recovery-code uses are audit-logged separately (mfa_recovery_consume) so you can tell at a glance when a user has been leaning on break-glass codes — a signal their primary factor might need re-enrolling.
No migration needed
Recovery codes live in the existing UserMFADevice table under device_type='recovery' — a row type we reserved when MFA first shipped. No new schema, no deploy gotchas. Just redeploy the backend and the option appears in every user's MFA settings.
Docs: developers.nexorix.com/syauth. Available today on every SyAuth plan.