The Binance 2FA backup key: where to keep it, and what to do when it's gone

When you bind an authenticator to Binance, the screen shows a QR code and a string of letters and numbers. Binance’s current official pages call that string the setup key. It is an important offline way to rebuild the same TOTP entry, but it is not the only route back: some authenticators support export or migration, and Binance provides an official 2FA reset process when the authenticator is unavailable. This piece covers four things: what the setup key is, where to keep it, how to check the copy, and what to do if it is lost or exposed.

Setup key, recovery code, QR — telling them apart

These labels should not be treated as interchangeable. Under Binance’s current pages and general identity terminology, they mean:

• The setup key: the string shown beside the QR code on the binding page. It is the TOTP shared secret or seed. Binance’s current Google Authenticator and BAuthenticator pages both use the term setup key; this article also calls it the backup key when discussing storage.
• A recovery or backup code: not automatically the TOTP setup key. NIST and many services use recovery code for a separate account-recovery credential, often usable only once. Binance’s current authenticator pages do not call the setup key a recovery code, so follow the exact wording on your account screen.
• The QR code: an encoded TOTP configuration containing the same secret plus account labels. Scanning it or entering the setup key manually creates the same TOTP entry.
• The rotating six digits: computed fresh every 30 seconds from "key + current time". That's the output, not a backup — copying it down achieves nothing.

An authenticator runs on the TOTP standard: the setup key generates rotating codes locally, with no internet connection or text messages involved. Entering that key on a new device rebuilds the same TOTP entry; some authenticator apps also provide an export or migration function. The key is separate from your fund password and login password, and must never be shared with a third party.

Why it matters more than your password

A forgotten login password has an official reset path. Authenticator codes are computed locally, so the original TOTP entry may disappear with a lost, deleted or wiped device. The setup key is an important offline way to rebuild that entry; an app export may be another. If neither is available, Binance’s identity-verification reset process can still restore account access.

It cuts the other way too: anyone with that string can generate the very same codes as you, ticking over in step, on their own phone. That's why it is both your lifeline the day you switch phones and a high-risk credential the moment it escapes. Treating it with the same care as a private key is not an overreaction.

Where to keep it, and the trade-offs

Two things: keep it offline, and keep two copies. The offline options come in a few forms — pick whichever suits you:

• On paper: simplest, and good enough. Write down which platform and which account it belongs to — the tail end of the email address is enough — so you're not left with a drawer of unlabelled scraps. Keep it somewhere fixed — a drawer, a safe — not tucked into something you'd throw out.
• A metal backup plate: if you already keep seed phrases this way, stamp it alongside them. Paper doesn't survive water or fire; metal does, which suits the copy you file away and never touch.
• An offline password manager: an entry in a locally encrypted manager that doesn't auto-sync to the cloud. The advantage is the note beside it — you can record which account the key belongs to and find it again years later. The catch is that the manager's own master password has to be strong and not lost.
• Two copies, kept apart: one to hand, one locked away — a desk drawer at work and a safe at home, for instance. Don't put both in the same bag; that's one place wearing a disguise.

And the convenient options that quietly store up trouble:

• A screenshot in your camera roll: lose the phone and the authenticator and the backup key go together — the very scenario you were keeping it for is the one where it fails first.
• A cloud note, your own inbox, a chat thread: any of those being rifled through or breached hands the key straight over. A 2FA seed sitting in plaintext in the cloud is one of the most common ways this goes wrong.
• Memorising it: a string that long won't survive a few months in your head, and one wrong character makes it useless.

Check it's right while the screen's still up

The cruel thing about a backup key is that a copying error feels like nothing at the time. You find out the day you actually need it, on a new phone, when the string simply won't work — and by then the original screen is long gone. So don't close the page the moment you've written it down. Spend a minute checking it.

Open a second authenticator app, choose "enter a setup key", type in what you copied — offline — and check that the six digits it produces are the same as the ones in the app you're binding, rolling over in step. Use a second app on the same device where you can; it sidesteps the trap below.

• They match: you've copied it correctly. Now either delete that entry from the second app and keep only the original, or deliberately keep it as a controlled spare authenticator — provided that device is one you also keep a firm grip on.
• They don't: don't conclude you miscopied it just yet. If the second app is on a different device, check that device's clock is set to automatic network time first — two clocks a few minutes apart will produce different codes from the same key, which makes a perfectly good copy look wrong. Once the clock is ruled out, it really is a dropped or mistyped character, or a stray space picked up when copying; copy it again from the screen while the key is still there. For the clock side of this, see the authenticator binding checks.

It works long after binding day too. No need to unbind anything: take the key off the paper (or the password manager entry), type it offline into a second authenticator app, and compare its six digits with the app you use day to day. If they match, the copy you're holding is sound and will work when it matters. It costs almost nothing, and it beats finding out on the day you switch phones.

Lost it or copied it wrong

If you find the backup key was never copied, was copied wrong, or can't be found, don't panic. Everything depends on whether you can still log in, and the two cases are handled completely differently.

You can still log in normally

While you still have access, follow Binance’s current website path: Security → Authenticator App → Manage, then select the edit control beside the authenticator. The replacement binding displays a new setup key; copy and verify it before finishing. Once the change is complete, the old setup key no longer generates valid codes for that account.

You're already locked out

If both the phone and setup key are unavailable, select the unavailable method on Binance’s security-verification screen and use “Security verification unavailable?” to start the official 2FA reset. Binance’s current page says a request under manual review may take up to 24 hours; withdrawals, P2P selling, internal transfers and payment services may then be unavailable for up to 48 hours. The full switching-and-recovery path is in moving your Binance 2FA to a new phone. If you also suspect an intrusion, follow the hacked-account guide first.

If you think it has leaked

If you realise the backup key may have been seen — screenshotted into a group chat, stored on a cloud drive that was breached, typed into a dubious site — there is one move: void the old one and issue a new one.

1. Change the authenticator immediately: if you can log in, use Security → Authenticator App → Manage / Edit; if you cannot complete verification, use the official reset. Do not delay the change to wait for a transfer.
2. Check devices and login history: open device management and unusual logins, look for devices you don't recognise, and drop any session you can't account for.
3. Shore up the other wards while you're there: confirm your anti-phishing code and withdrawal whitelist are in place. 2FA was never meant to stand on its own.

A checklist to work through

Whether you're binding for the first time or fixing it after the fact, this is the order:

1. While binding, find the backup key on screen — not the QR code, not the six rotating digits.
2. Copy it offline: paper, metal or a local password manager. Note which account it's for. Two places.
3. Verify on the spot: type it offline into a second authenticator and check the six digits match.
4. Only then finish the binding, and log out and back in once to prove the route works.
5. Never copied it → first check for a trustworthy app export; if you need to change the Binance authenticator, use Manage / Edit and allow for the 24-hour withdrawal and P2P restriction.
6. Locked out → use “Security verification unavailable?” for the official reset; affected services may be unavailable for up to 48 hours.
7. Possible leak → change or reset immediately, check devices and shore up the rest; do not delay for a withdrawal.

Before a phone switch, tick through the new-phone 2FA migration checklist.

Common questions