RecoveryCodes

RecoveryCodes is an MFA continuity inventory platform that maps the accounts, multi-factor authentication (MFA) devices, and recovery codes your company depends on, so you know what breaks before an authenticator is gone. It runs as a web app hosted in the EU and is aimed at organizations that need to track MFA enforcements outside their identity provider.

What is RecoveryCodes?

RecoveryCodes is a web-based inventory tool that records every account, the authenticators assigned to it, and the recovery codes needed to regain access. It takes as input your accounts outside the identity provider — such as bank portals, registrars, vendor portals, and founder accounts — and produces a map of authenticator assignments, risk statuses, and audit reports. The platform is made by RecoveryCodes (recoverycodes.eu) and stores all data in the EU.

Key Features

• Account and enrollment tracking — Add unlimited accounts and authenticators, assign multiple authenticators per account, and mark statuses like protected, one device risk, or no 2FA yet.
• Recovery code vault — Store recovery codes per domain without holding TOTP seeds; codes remain separate from your password vault and every reveal requires step-up authentication.
• Reverse lookup for devices — For any authenticator (YubiKey, phone, TOTP app), see every account it protects in one click, so you know exactly what to re-enroll before decommissioning it.
• Audit reports — Export coverage reports, one-device-risk lists, offboarding attestations, and access logs as JSON for security reviews and ISO 27001 audits.
• Workspace sharing — Share selected domains and authenticators with approved workspace members, with role-based access.
• Sign-in protection — Access the tool via social login (Google, GitHub, GitLab), passkeys, or organization SSO (OIDC, with SAML/SCIM/LDAP on Enterprise).
• EU data storage and encryption — Recovery code values are encrypted with per-code data keys wrapped by KMS infrastructure in the EU; no TOTP seeds are stored.

Who is it for?

• IT and security administrators — Track MFA coverage for accounts outside Okta/Entra and get a single inventory for audits.
• Offboarding teams — Identify every authenticator a departing employee holds and transfer access before revoking, avoiding lockouts.
• Compliance officers — Export dated evidence of MFA coverage, one-device risks, and offboarding attestation for ISO 27001 reviews.

What can you do with RecoveryCodes?

• Security teams: Map bank portals, registrars, and vendor accounts to specific authenticators, and spot accounts protected by only one device.
• Admins before hardware refresh: Use reverse lookup to see the 14 accounts tied to security key 1, then re-enroll them before decommissioning the key.
• Auditors: Generate coverage and risk reports as PDFs or JSON, and show the access and change log for recovery codes.

How does RecoveryCodes work?

Sign in with Google, GitHub, GitLab, or a passkey. Add accounts and authenticators, then assign authenticators to each account. RecoveryCodes tracks statuses automatically and builds the reverse lookup. When you need to act, you can export reports or share domains with workspace members.

Pricing

RecoveryCodes offers a 14-day free trial with no credit card. Paid plans: Inventory at 39–49 €/month (billed annually or monthly), Compliance at 119–149 €/month, and Enterprise with custom pricing. Inventory covers unlimited accounts and authenticators, reverse lookup, recovery code tracking, and a 90-day audit log. Compliance adds exportable offboarding attestation, extended audit retention, and OIDC SSO. Enterprise adds SAML/SCIM/LDAP, self-hosting, customer-managed KMS keys, and custom retention.