recoverycode

Overview ¶

Package recoverycode makes and checks 2FA recovery codes: single-use codes a user keeps for when they lose their authenticator.

Each code is 16 random base32 characters (80 bits), shown in groups of four. Codes are stored as SHA-256 hashes. That's enough: slow hashes like argon2 exist to resist guessing passwords that people choose, and an 80-bit random code can't be guessed either way (docs/api.md §8).