Backup codes and getting back into your account

Two-factor authentication protects your account — and locks you out too if the only device that can produce a code is at the bottom of a lake. Backup codes exist for exactly that day.

Generating your codes

1. Sign in at dash.mypandos.io and open Profile → Security.
2. Find Backup Codes and choose Generate Backup Codes.
3. Confirm it is you when the “Confirm it's you” prompt appears — a one-time code sent by email, WhatsApp or SMS if you sign in through myPandos SSO, or your password if you sign in with a local myPandos password.
4. A set of 10 codes, each 8 characters long, is displayed. You can Copy All, Download or Print them.
5. Save them somewhere safe, then confirm with I've saved my codes.

They are shown once. The dashboard stores only a hash of each code and can never display them again — if you lose them, your only option is to generate a new set.

How they behave

• Each code works once. Once used it is spent.
• The Security tab shows how many you have left, warns you when you are running low, and warns you again when you have none.
• Regenerating replaces the whole set — every unused code from the previous batch stops working immediately. Do not regenerate on a whim while your old list is the only copy you have.
• The codes deliberately avoid characters that are easy to confuse, so there is no ambiguity between 0 and O, or 1, I and L when you type or write them out.

Where to keep them

• Good: a password manager, or printed and kept somewhere you keep other important documents.
• Bad: your email inbox, a note on your phone's home screen, or a file called passwords.txt. If someone reaches your email, backup codes stored there hand them your second factor as well.

Recovery codes vs backup codes

You may see both names on the Security tab. Recovery codes are a method you add under Multi-factor authentication, managed by myPandos SSO. Backup codes are the fallback managed by the dashboard itself. Both are single-use and serve the same purpose — having either one saved is what matters.

If you have lost your authenticator and have no codes

Do not create a second account — that separates you from your services and makes recovery harder.

1. Contact us from the email address on the account: open a ticket at dash.mypandos.io/en/support if you can still get that far, or email [email protected].
2. Say clearly that you have lost access to your two-factor method.
3. Expect us to verify your identity before we change anything. Account-recovery requests are handled more carefully — and therefore more slowly — than ordinary tickets, because the whole point of 2FA is that it cannot be talked around.

Once you are back in

Generate a fresh set of backup codes straight away, add a second multi-factor method so this cannot happen again, and check Login History and Active Sessions for anything you do not recognise.