How to Set Up Backup Codes for Your my Social Security Account

Last updated 3 days ago ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

The Social Security Administration has updated its security procedures for accessing your personal information online. If you used a Social Security username and password you created before September 18, 2021, that login method is no longer available.

As of June 7, 2025, the SSA mandates the use of two external sign-in partners. You are now required to use either a Login.gov or an ID.me account to access your sensitive personal information, check your benefits, and use any online services.

Your Two Login Options

When you go to the my Social Security sign-in page, you must choose one of these two services to create an account or log in. You only need one.

Login.gov: This is a secure sign-in service provided by the U.S. government itself, managed by the General Services Administration (GSA). It is designed to be a single, trusted account for accessing participating government agencies.

ID.me: This is a private, trusted technology partner that provides secure digital identity verification. It meets the U.S. government’s high standards for online identity proofing and is also used by other agencies, such as the Department of Veterans Affairs.

If you already have a Login.gov or ID.me account that you use for other government services (like USAJOBS or VA benefits), you can and should use that existing account to access your My Social Security services.

Why Multi-Factor Authentication Matters

This change was made to implement a stronger form of security called Multi-Factor Authentication (MFA), sometimes called two-step or second-factor authentication.

MFA is a layered approach to security that is 99% less likely to be hacked than a simple password. It requires you to present two or more forms of identification when you log in:

• Something you know: Your password
• Something you have: A one-time security code, typically sent to your smartphone or generated by an authenticator app

This system is crucial for protecting your account from unauthorized use and identity fraud. However, it creates a significant challenge: what happens if you don’t have a smartphone, or if you lose the phone you use for authentication?

The official solution is a “backup code.”

Because the SSA has delegated its login system to these two partners, the SSA itself can no longer help you with most login problems. Your login security, including your backup codes, is managed entirely by either Login.gov or ID.me.

These services were designed with accessibility in mind for those who may not own a smartphone. If you only have a landline, share a phone, or prefer not to use a mobile device, backup codes are one of the primary, officially supported methods for you to securely access your account.

What Is a Backup Code?

The simplest way to think of a backup code is as a digital spare key for your account.

When you lose your primary “key”—for example, your phone is lost, broken, or you get a new number—a backup code is a pre-generated, single-use password that lets you unlock your account and get back in.

It is a form of MFA that does not require a phone. After you enter your username and password, you will be asked for your one-time code. Instead of getting that code from your phone, you can use one of your pre-generated backup codes from the list you saved.

Critical First Step: Which Service Do You Use?

Before you read any further, you must identify which service you use to log in to your My Social Security account.

The instructions for Login.gov and ID.me are completely different.

The methods for creating codes, the number of codes you get, and the process for what to do if you are locked out are not the same.

The Terminology Problem

The single greatest source of confusion in this process is that Login.gov and ID.me use different and overlapping terms for their backup systems.

Login.gov has one system called “Backup Codes.”

ID.me has two different systems that sound similar:

• A single “Recovery Code”
• A set of 12 “Backup Codes”

The ID.me Help Center states this plainly: “Note: Backup codes are different from recovery codes.”

This guide will provide separate, step-by-step instructions for all three of these options.

Comparing Your Options

The following table breaks down the key differences between the login partners and their backup systems.

Table 1: Comparing Backup Methods for my Social Security Login Partners

The two services have different philosophies. Login.gov’s documentation actively discourages using backup codes as your only method, calling them “less secure” because a physical piece of paper can be stolen. Their system treats backup codes as an emergency-only option.

ID.me, by contrast, presents its “Backup Codes” as a standard, valid MFA method, just like an authenticator app. The fact that their system is designed to automatically regenerate codes for continuous use suggests it is a more robust and flexible option for those who must rely on a printed list.

How to Create Login.gov Backup Codes

This section is only for users who have chosen Login.gov to access their My Social Security account.

When you follow this process, you will receive a single list containing ten (10) single-use codes.

Setup Process

A critical point for Login.gov is that you cannot create backup codes when you first create your account. You must first set up at least one other primary authentication method (like a phone number, authenticator app, or physical security key).

Only after your account is created and you can successfully sign in can you add backup codes as a secondary method.

1. Go to the my Social Security sign-in page and select the option to sign in with Login.gov.
2. You will be redirected to the Login.gov secure sign-in page.
3. Enter your email address and your Login.gov password.
4. You will be prompted to authenticate using your primary method (e.g., entering the code sent to your phone or app).
5. After you successfully authenticate, you will be taken to your Login.gov account page.
6. On your account page, look for the “Your authentication methods” menu, which is typically on the left side of the page.
7. Select the option to “Add” a new authentication method.
8. From the list of options, choose “Backup codes.”
9. Login.gov will immediately generate and display a list of 10 unique codes.

You must save this list immediately. You will not be shown it again. Your options are to:

• Print the list
• Download the list as a text file
• Copy and paste the codes into a secure location

You will be asked to confirm that you have saved your codes in a safe place. Once you do, “Backup Codes” will be listed as one of your active authentication methods.

How to Use Your Login.gov Backup Codes

1. Go to the my Social Security sign-in page and choose to log in with Login.gov.
2. Enter your Login.gov email and password.
3. The system will ask you to use your primary authentication method (e.g., your phone). On this screen, look for a link that says “Choose another security option.”
4. Click that link. You will now see a list of all the authentication methods you have enabled.
5. Select “Backup code” from the list.
6. You will be prompted to enter one of your 10 codes. Type one code in exactly as it appears on your list.

Each code may be used only once. It is highly recommended that you cross the code off your printed list after you use it.

When you successfully use your 10th and final code, Login.gov will automatically prompt you to download a new list of 10 codes.

How to Create ID.me Backup Systems

This section is only for users who have chosen ID.me to access their My Social Security account.

Understanding Your Two Options

ID.me offers two distinct backup systems. We recommend you set up both to ensure you are never locked out.

Recovery Code: A single, one-time “emergency key” you generate during your initial account setup.

Backup Codes: A set of 12 codes that you can set up as a standalone login method at any time.

How to Generate Your ID.me Recovery Code

This is a “now or never” opportunity. The option to generate your single Recovery Code is only offered at the very end of your initial Multi-Factor Authentication (MFA) setup. If you skip this step, you cannot go back and do it later.

1. When you are first creating your ID.me account, you will be prompted to set up your primary MFA method (e.g., Push Notification, Text Message, etc.).
2. Follow the on-screen steps to set up that method.
3. At the very end of this process, you will see a confirmation screen telling you your account is secure.
4. On this final screen, look for a button or link that says “Generate recovery code.” Do not click “Finish” or close the window until you have done this.
5. Select “Generate recovery code.”
6. ID.me will display a single, unique recovery code.
7. Select “Download a copy” to save it as a PDF, or carefully write the code down.

Store this code in an extremely safe place. This code is your single best lifeline if you lose your primary MFA device.

How to Set Up ID.me Backup Codes

This system provides you with a list of 12 codes that you can use as your regular way to log in, making it an excellent option if you do not have a reliable mobile phone. You can set this up at any time from your ID.me account settings.

1. Go to ID.me and log in to your account.
2. Navigate to your account settings and find the tab or menu for “Sign In & Security.”
3. In the “Multi-Factor Authentication” section, select the option to add a new MFA method.
4. When prompted to choose your new method, select “Backup Codes.”
5. The system will immediately display a list of 12 unique backup codes. These are numbered 1-12 to help you track which ones you have used.
6. You must write down, print, or save this list to your device.
7. To confirm you have saved the codes, ID.me will then require you to enter one of the codes from the list (e.g., “Please enter code #7”).
8. Enter the requested code. “Backup Codes” will now be activated as one of your available MFA methods.

How to Use Your ID.me Codes

Using the Recovery Code: When you are logging in and cannot use your primary MFA method, look for an option to use a different method. Select “Recovery code.” Enter the single code you saved. After you successfully sign in, ID.me will immediately issue you a new recovery code, and the one you just used will become invalid.

Using the Backup Codes: When you are logging in, select “Backup Codes” as your authentication method. You will be prompted to enter one of your 12 codes. After you use your 12th and final code, the system will automatically generate 12 new codes (numbered 13-24, etc.) for you to save.

How to Store Your Codes Securely

Treat Codes Like Your Social Security Card

You must treat your list of backup codes with the same level of security as your password, your Social Security card, or your passport. Anyone who finds this list can access your account.

The Storage Problem

Login.gov warns that printed codes are “vulnerable to theft and phishing.” This is true. If a thief breaks into your home and finds the list, they can use it.

However, the entire purpose of a backup code is to recover your account when you lose your primary digital device (your phone). This creates a problem:

Storing your backup codes in a digital “notes” app on your phone is useless, as the codes will be lost along with the phone.

Storing your codes in a cloud-based password manager is also extremely risky. If you use your phone to authenticate and open your password manager, you have locked yourself out of both your account and the spare key you need to get back in.

For this reason, the most logical and secure solution for backup codes is a physical, offline storage method that is separate from your other digital devices.

Storage Recommendations

Bad Storage (Do NOT do this):

• In a file on your computer’s desktop (e.g., “ssa_codes.txt”)
• In an email you send to yourself
• In the “notes” app on the same phone you use for authentication
• Saving the file in an unencrypted cloud drive like Google Drive or Dropbox

Okay Storage (Still Risky):

• In a Password Manager. While password managers are encrypted, this is only safe if you are 100% certain you can access your password manager without needing your phone. For most people, this creates a circular dependency problem and is not recommended.

Good Storage (Recommended):

• Print the list of codes
• Store this printed paper in a locked file cabinet, locked desk drawer, or a secure personal safe at home
• The Social Security Administration itself advises that documents containing Personally Identifiable Information (PII) should be kept in a locked file drawer or cabinet. Treat your code list the same way.

Best Storage (The Expert Method):

• Print two copies of the codes
• Copy 1: Store this in a fireproof, locked safe in your home
• Copy 2: Store this in a completely different and secure location. This could be a safe deposit box at your bank or in a sealed envelope with your will and other essential legal documents given to a trusted family member or your attorney.

This ensures that even if your home is compromised (by theft, fire, or flood), you still have a way to access your vital benefits.

This level of physical security is consistent with recommendations from the Cybersecurity and Infrastructure Security Agency (CISA), which advises users to “safely store your recovery key and password.”

What to Do If You’re Locked Out

This is the worst-case scenario: you have lost your phone, and you cannot find your backup codes. You are completely locked out.

Your recovery path from this point is completely different depending on which service you chose. This is arguably the most significant functional difference between Login.gov and ID.me.

If You’re Locked Out of Login.gov

If you lose access to all your authentication methods (phone, app, etc.) AND you have lost your backup codes, you are locked out.

You cannot request new backup codes. You can only generate new codes after you have successfully signed in.

Your only solution is to delete your account and start over.

This is a “nuclear” option, but it is the only one Login.gov provides to maintain security.

Here are the steps to delete your account:

1. Go to the Login.gov sign-in page.
2. Enter your email address and password.
3. On the authentication page, click the link that says “Choose another security option.”
4. At the bottom of the next screen, click the link for “deleting your account.”
5. Read the information carefully and confirm by clicking “Yes, continue deletion.”
6. You will receive two emails. The first is an immediate confirmation. The second email will arrive 24 hours later. This 24-hour waiting period is a security feature.
7. You must open that second email and click the final link to complete the deletion.

After your account is permanently deleted, you must go back to the SSA website and create a new Login.gov account from scratch.

If You’re Locked Out of ID.me

If you are locked out of your ID.me account, you have a much better option.

You do NOT need to delete your account.

ID.me has a robust “MFA recovery process” that allows you to prove your identity and regain access.

Here are the steps to recover your account:

1. Go to the ID.me sign-in page.
2. Enter your email address and password.
3. On the “Complete Your Sign In” screen, where it asks for your MFA code, select the link for the “MFA recovery process.”
4. You will be required to “confirm account ownership.” This can be done in several ways:
   • Taking a live video selfie with your computer’s camera
   • Uploading photos of your identity documents (like a driver’s license or passport)
   • Joining a live video call with a trusted ID.me agent who will verify your identity
5. Once you have successfully proven you are who you say you are, you will be prompted to set up a new MFA method. You can then log in and access your account.

If You Don’t Have a Smartphone

Backup codes are not the only solution for users without a smartphone. Both services offer other excellent accessibility options.

For Login.gov: During setup, you can choose to receive your MFA code via a phone call to your landline. You can also purchase and use a physical security key (a small USB device).

For ID.me: You can also choose to receive your code via a phone call to a landline. Additionally, if you are having trouble with other methods during setup, you can often choose to verify your identity on a live video call with an agent.

Common Questions

Where do I go to log in to my Social Security? You can sign in or create an account by visiting the official Social Security website.

Do I need both a Login.gov and an ID.me account? No. You only need to choose one. If you already have an account with either service for other government websites, you can use that existing account.

What if I use all my backup codes? For Login.gov, you will be prompted to download a new list of 10 codes after you use the last one. For ID.me, 12 new codes are automatically generated for you to save after you use the 12th code.

What if I need help? Who do I contact? This is the most important troubleshooting step. The Social Security Administration (SSA) cannot reset your password or manage backup codes for your Login.gov or ID.me account (for any account created after September 18, 2021).

You must contact the help center for the specific service you use:

• For Login.gov help: Go to the Login.gov Help Center
• For ID.me help: Go to the ID.me Help Center

If you call the SSA Help Desk at 1-800-772-1213, they will almost certainly redirect you to Login.gov or ID.me for any problems related to signing in.

Our articles make government information more accessible. Please consult a qualified professional for financial, legal, or health advice specific to your circumstances.