Where to Find Instagram Backup Codes

The short version: Instagram backup codes live inside Settings under Accounts Centre, Password and Security, Two-Factor Authentication, and they only show up the moment you turn two-factor on or regenerate them. If you didn't save them then, you can't go digging for them later, you have to generate a fresh set, which is the bit most guides gloss over.

I manage social accounts for my own business and I've watched enough business owners panic about locked logins to know this is one of those small admin jobs people only think about once it's already gone wrong. So let's sort it.

What Instagram backup codes are

Backup codes are single-use codes, eight of them, that let you log into Instagram if you've switched on two-factor authentication but can't get your usual code by text or authenticator app. Think lost phone, dead SIM, new country, or your authenticator app vanishing in a factory reset. Without them, and without access to your phone number or authenticator, you're locked out of your own account with no easy way back in.

Instagram gives you these codes once, when you set up two-factor authentication. They're not emailed to you, they're not stored anywhere you can casually browse to six months later, and Instagram will not read them out to you over a support chat. That's the uncomfortable bit nobody likes saying plainly: if you never wrote them down, they are effectively gone until you generate new ones, and generating new ones requires you to already be logged in.

Where to find them right now, step by step

If you're currently logged into Instagram on your phone, here's the path:

• Open Instagram and tap your profile picture bottom right
• Tap the three lines top right, then Settings and privacy
• Tap Accounts Centre, then Password and security
• Tap Two-factor authentication
• Select your Instagram account from the list
• Tap Backup codes

If two-factor authentication is already switched on, this screen shows you the option to get new codes. It won't reveal the original eight, because Instagram deliberately doesn't let anyone view already-issued codes again, even you, even with full account access. You tap "Get new codes" and the old set stops working the moment you do.

On desktop the route is the same logic: go to instagram.com, click your profile icon, Settings, Accounts Centre, Password and security, Two-factor authentication. Same screen, same rule.

A worked example

Say you run a small skincare brand on Instagram with about 4,200 followers, and eighteen months ago you set up two-factor authentication because Instagram nudged you to after a suspicious login attempt. You saved the eight backup codes as a screenshot in your camera roll. Then you upgraded your phone, did a full data transfer except for that one folder of random screenshots you never bothered moving, and now your authenticator app is gone with the old handset.

You still have your phone number, so in practice you'd use the SMS option rather than backup codes. But say your number changed too, because you moved country for six months and swapped SIMs. Now you're stuck: no authenticator, no SMS, no backup codes. Your only route back in is Instagram's account recovery form, which asks for ID verification and can take anywhere from a few hours to several days depending on volume. That gap, days without your business account, is the actual cost of not storing backup codes, not some vague "it's a good idea" advice.

Where to store them so this doesn't happen

A screenshot in your camera roll is better than nothing but it's a weak system, because camera rolls get lost, phones get wiped, and screenshots are not searchable six months later when you've forgotten what you called the file.

Better options, in order of what I'd trust:

• A password manager like 1Password or Bitwarden, saved as a secure note attached to the Instagram login entry
• A printed copy kept with other business paperwork, not stuck to a monitor
• An encrypted note in whatever system you already use for business passwords, as long as it's backed up somewhere other than the one device

Whatever you pick, the rule is simple: store it somewhere that isn't the phone that might be the thing that fails. People keep backup codes on the same device they're meant to back up, which defeats the entire point.

If you manage the account for a client or a team

This is where it gets messy for small businesses. If you're the social media manager and you set up two-factor authentication on a client's Instagram, the backup codes should go to the client, not just live on your laptop. I've seen agencies hold all the login security for a brand with zero documented handover, and when that agency relationship ends, the brand is locked out of fixing their own account. If you're outsourcing any part of your social or messaging strategy to someone else, put "who holds the backup codes" on the contract, not just a verbal agreement.

What to do if you've lost both your phone and your codes

Go to the Instagram login screen and tap "Get help logging in" or "Forgotten password". Instagram will ask for your username, email, or phone number, and will likely ask you to verify your identity, sometimes with a video selfie matched against your profile photos. For a business account this can take a few days, which is painful if that account is your main sales channel. This is also roughly the same headache people run into when they've lost access after changing their Instagram email without updating recovery details first, it's the same root problem of not keeping account recovery information current.

A quick word on two-factor authentication itself

Some business owners turn it off entirely because backup codes feel like one more thing to manage. I'd push back on that. A hacked Instagram business account, especially one linked to ads or a WhatsApp Business catalogue, is a far bigger mess than spending ten minutes storing eight codes. If you're running WhatsApp Business alongside Instagram, or logging into business messaging on the web, the same login hygiene applies across the board, not just to Instagram.

Frequently asked questions

Can I see my old Instagram backup codes after I've lost them?

No. Instagram only displays backup codes once, at the moment they're generated, and there's no settings page that lets you view a previously issued set. You have to generate new codes, which requires being logged into the account first.

How many backup codes does Instagram give you?

Instagram issues eight backup codes at a time, each one usable only once. Once you've used all eight, or you generate a new set, the old codes stop working.

Do Instagram backup codes expire?

They don't expire on a timer, but they do become invalid the moment you generate a new batch, and each individual code is single-use, so it's spent as soon as you log in with it.

What if I don't have two-factor authentication turned on at all?

Then you have no backup codes to find, because Instagram only creates them when two-factor authentication is switched on. Go to Settings, Accounts Centre, Password and security, Two-factor authentication, turn it on, and save the eight codes the moment they appear.