RecoveryCodes is an EU-hosted MFA continuity inventory that maps the accounts, authenticator devices, and recovery codes your company depends on. It fills the gap left by identity providers and password managers by tracking which bank portals, registrars, root accounts, and vendor portals rely on a specific phone or security key. The tool stores recovery codes per domain without holding TOTP seeds, so it serves as an emergency record rather than a shared authenticator. It provides reverse lookups to see every account a device protects, status labels for protection levels, and audit logs for sensitive actions.
What is RecoveryCodes?
RecoveryCodes is a SaaS inventory tool for managing multi-factor authentication (MFA) continuity. It takes as input your accounts, authenticators (security keys, TOTP apps, SMS, passkeys), and recovery codes, and produces a structured inventory with risk status, reverse lookups, and exportable audit evidence. The platform runs in the EU with KMS-wrapped encryption and does not store TOTP seeds. It is made by RecoveryCodes (recoverycodes.eu).
Key Features
- Unlimited inventory — Add unlimited accounts, authenticators, and assignments; track ownership and physical location.
- Recovery code storage — Store recovery codes per domain without sharing TOTP seeds; reveal requires step-up authentication and audit logging.
- Reverse lookup — See every account a specific authenticator protects in one click, essential for device replacement.
- Risk status labels — Mark accounts as protected, one device risk, or no 2FA yet; best practice default of 2 MFA devices per domain.
- Audit and export — Export inventory and audit evidence as JSON; access and change logs track who viewed codes or changed enrollments.
- Offboarding attestation — Generate dated, exportable reports of a departing user's authenticators and accounts for proof of transfer.
- SSO and passkey login — Sign in with Google, GitHub, GitLab, or passkeys; OIDC SSO on Compliance plan, SAML/SCIM/LDAP on Enterprise.
Who is it for?
- IT administrators — Map MFA dependencies outside the IdP to prevent lockouts during device changes or offboarding.
- Security teams — Generate MFA coverage reports and one-device risk lists for audits and ISO 27001 compliance.
- Compliance officers — Export offboarding attestations and access logs to prove MFA continuity in reviews.
- Founders and small businesses — Track founder accounts and vendor portals that rely on personal phones or keys.
What can you do with RecoveryCodes?
- Device replacement: Before retiring a security key or phone, run a reverse lookup to see all 14 accounts that need re-enrollment.
- Offboarding: Transfer MFA from a departing employee to another owner before revoking access, avoiding outages.
- Audit preparation: Export a coverage report showing every account's 2FA status and the authenticators enrolled, ready for ISO 27001.
- Recovery code management: Store and share recovery codes per domain with workspace members, with step-up authentication for viewing.
How does RecoveryCodes work?
Start with a 14-day free trial (no credit card). Add accounts and authenticators, assign them, and store recovery codes per domain. The tool automatically flags one-device risks and provides reverse lookups. Sensitive actions like viewing codes or changing assignments require fresh authentication. Export JSON reports from the dashboard.
Pricing
Paid plans with a 14-day free trial. Inventory plan at €49/month (€39 annually), Compliance plan at €149/month (€119 annually), Enterprise with custom contract. All prices exclude tax.
