A recovery code (also called backup code) is a single-use string generated when 2FA is enabled, used to regain access to an account when the second factor is lost (phone broken, YubiKey lost, authenticator app data wiped). Most services issue a set of 8 to 16 codes at 2FA setup; using one consumes it. The codes are the only path back into the account when the primary 2FA fails, which makes them the silent weak link in 2FA setups that are otherwise strong.
What it means in practice
The recovery codes are functionally equivalent to a working 2FA token. An attacker who steals the printed codes from a desk drawer or extracts them from a screenshot stored in iCloud bypasses the entire 2FA chain. Yet most users either lose the codes (defeating the recovery purpose) or store them insecurely in the same vault as the password (defeating the 2FA purpose). The operational answer is to treat recovery codes with the same handling discipline as a hardware key’s backup: print on paper, store offline in a different physical location from the daily-driver device, never store digitally except inside an air-gapped or strongly-encrypted vault.
Where it shows up
Generated by: every service that offers TOTP or hardware-key 2FA (Google, Microsoft, Apple, GitHub, Bitwarden, 1Password, Proton, Twitter, Facebook, the entire ecosystem). Stored insecurely by: most users (a screenshot saved to Photos, a text file on the desktop, a sticky note on the monitor). The high-leverage moment is the moment of generation: when the service displays the codes during 2FA setup, that is the only window when the user can decide whether the codes will be useful (printed, stored offline) or actively harmful (captured in a synced cloud backup that an attacker can later access).
What you can change today
Audit recovery codes for your 5 most important accounts (primary email, password manager, financial accounts, GitHub if applicable, social media if it is part of your livelihood). For each, check: do you have the codes, are they stored offline, are they not in a cloud-synced location. If any answer is no, regenerate the codes (Account Settings, Security, Regenerate Backup Codes) and store the new set on paper in a fireproof safe or with a trusted physical-world contact. While you are there, audit the recovery codes for the recovery account itself; the recursive weakness applies. The whole pass takes 30 minutes and closes one of the most common 2FA bypass paths.