Steam revocation code: what it is, and how to get it back
It looks like R12345. Valve calls it your recovery
code; SDA and the maFile format call the same field
revocation_code, though not every exported file contains one. It
can be the difference between completing recovery yourself and having to prove
account ownership to Steam Support.
Your recovery code is a short R-code that lets you
detach the Steam Guard authenticator from your account
without access to the device it runs on. It is shown when you enrol, and it
can be retrieved again while the authenticator still works.
It is not a login code and not a second password. On its own it cannot open your account. If the authenticator is lost, Steam may still let you transfer it using an SMS code when a phone number is linked; without either that route or this code, Steam Support is the remaining option — and it will verify the account is yours first.
What does the recovery code actually do?#
The recovery code detaches the authenticator from your account without the device the authenticator is on. Dead phone, wiped disk, stolen laptop — it is a recovery secret stored separately from the authenticator, so it can still work after the device is gone.
It is not a master key on its own, and it is worth being exact about that. Steam's recovery process also checks account access or ownership. You do not necessarily need to be already signed in to begin that process. The public implementation of the removal API requires an access token as well as the recovery code; that API detail is not a complete specification of Steam's web recovery wizard. The recovery code does not generate login codes or confirmation signatures.
Where do I find my Steam recovery code?#
It is shown once when the authenticator is created, and many people never look at it again — but it is not gone if you still have a working authenticator. Valve's answer to "I didn't save my recovery code" is direct:
In Steam Mobile, open Steam Guard → gear icon → Recovery Code. Valve documents this in its FAQ.
Save it while you have access. Losing the device can remove the easiest way to retrieve it, but a previously saved note or backup may still contain the current code.
Other places a copy may survive:
-
Inside a maFile. If the authenticator was ever held by a
desktop tool, a typical file carries a
revocation_codefield. Any surviving copy that included the field still preserves it — an old machine, an old backup — but a maFile exported without one never had it to keep. -
Screenshots and notes. The setup screen told you to save it,
and plenty of people screenshotted it. Search your images and your password
manager for anything starting with
R.
How do I use it to remove an authenticator?#
-
Go to Steam's own help site
Open Steam Support, choose Help, I can't sign in, then the lost or deleted mobile-authenticator option. Identify your account and follow the ownership checks. The exact choices depend on the recovery methods still available.
-
Use the recovery-code option when Steam offers it
Enter the code only in Steam's own recovery form and read the confirmation before approving removal. The code alone does not skip the other checks.
-
Set up a fresh authenticator
Whichever you intend to use from now on — and write down the new recovery code, because the old one is gone with the old authenticator.
Removing costs fifteen days. A removal carries a fifteen-day trade and Market restriction, which is why transferring is the better path whenever you still can — that one costs two. Steam Support cannot lift the restriction and nothing legitimate bypasses it.
Treat the code as sensitive. Combined with other account access, it can allow authenticator removal. Enter it only into Steam's own recovery or authenticator-removal form. Do not send it to a person who contacts you or include it in a third-party support request, including ours.
Common questions about the recovery code#
Is the recovery code the same as a backup code?#
No, and confusing them is common. A backup code is a one-use replacement for a login code — it gets you signed in. The recovery code does not sign you in at all; it is used to detach the authenticator from the account. Different jobs, different moments.
Does the recovery code ever change?#
It belongs to the authenticator, not to the account — so it stays the same for as long as that authenticator does, and a new one comes with a new code. If you have written down a code from an authenticator you have since replaced, what you are holding is a relic.
Can someone steal my account with the recovery code alone?#
It is not a normal sign-in credential. Steam also checks account access or ownership during recovery. Still treat a leaked code as a compromised recovery secret and review account security; do not assume it is harmless because your password was not included.
What if I never wrote it down and the device is gone?#
First check for a working backup and whether you can receive messages at Steam's linked phone number. Valve documents an SMS transfer route for a lost authenticator. If neither works, use Steam Support. The lost-access page explains the recovery order.
How should I store it so this does not happen again?#
Write it on paper, keep the paper somewhere the device is not, and check it is still readable when you think of it. A code stored only on the device it revokes is not a backup — losing the device loses both at once.
Open Desktop Authenticator asks you to save the recovery code and acknowledge it during setup. Finish that step and the encrypted recovery backup before treating the setup as complete. During a transfer, Steam has already replaced the authenticator by the time the new code is shown; this is a recovery step for an account change that has already happened.