Steam Guard backup codes: how to get them, use them and replace them

Both get filed as “the code I saved for emergencies”, which is how people end up typing an R-code into a sign-in box. They do different jobs.

Backup codes are a list you create on the Steam website under Manage Steam Guard. Each one can be entered where Steam wants the code from your phone, so they get you signed in.

The recovery code is one code that begins with R. Steam shows it when you finish adding the mobile authenticator, and it exists to take the authenticator off your account when you cannot use it, for example after losing a phone on an account with no number. Missed it? The Steam Mobile App shows it again under the gear icon on the Steam Guard page, but only while you still have that phone.

Steam’s FAQ does not say how many codes come in a set, whether each one works only once, or what happens to an old list when you make a new one. So treat every code as single-use, cross it off when you use it, and generate a new set while a few are left.

A new list needs the same two things as the first: a signed-in session and a text to the number on the account. Down to your last code and signed out? Use it to get in, then make the new set first thing.

If texts are not arriving, check the number under Contact Info in Account Details. Steam refuses VoIP numbers and pauses texts after too many have been sent, so waiting a few minutes to an hour can help.

Steam is direct about this: print the codes instead of saving them on your computer, and do not take a screenshot. A file on a PC is only as safe as that PC, and Steam’s security recommendations tell you to scan regularly for keyloggers, spyware and other malware.

Never type a backup code into a page you reached from a link, and never read one out in a chat. Steam Support says it will never ask for your codes, and Steam’s scam pages treat a request for a code sent by email, SMS or the mobile app as a sign you are dealing with a scammer.

Want a digital copy too? Keep it in an encrypted vault, not a notes app. LoginScout can hold the list in the notes on your Steam card, next to the R-code, with used codes crossed off. Keep at least one copy away from the phone that runs the authenticator, and if Steam emails you about a code you did not use, change your password and generate a new set straight away.

Backup codes only help while your password still works. If someone else changed the password or the email, that is a stolen account, and it goes through Steam Support’s recovery path rather than the Steam Guard prompt.

If the phone is gone and no backup codes are left, work down Steam’s own order: a replacement phone with the same number lets Steam text you, and the R-code removes the authenticator without a number. With neither, Steam’s FAQ points you to the Help me with my issue button to get the authenticator removed. If you can no longer reach the email on the account, add proof of ownership, which Steam bases on payment details used on the account or retail product codes activated on it.

Do not pay anyone who offers to strip Steam Guard off for you. Steam’s scam FAQ says you can always recover your account through Steam Support, even when a scammer has changed all of its details.