Open Desktop Authenticator

Steam revocation code: find it or choose a recovery route

Reviewed by MASTERPANEL LLC 3 min read Sources and testing: Phone recovery steps checked against Valve's Steam Guard guidance; ODA recovery storage against its recovery-file implementation Editorial method

Valve calls it a recovery code; SDA files may store it as revocation_code. It helps remove a lost authenticator through Steam's recovery process. It is different from the changing login code and the one-use backup login codes.

Start with what you still have
  • The phone authenticator still works: open Steam Guard, tap the gear, then Recovery Code. Record it somewhere accessible without that phone. You do not need to remove the authenticator to view it.
  • You retained a code or desktop backup: check that it belongs to the current authenticator. A maFile may contain revocation_code; an encrypted file must be opened with its matching metadata and passphrase first.
  • You have neither: if you can receive messages at Steam's linked number, try its phone-transfer recovery route. Otherwise use Steam Support and follow its account-ownership checks.

The phone path above follows Valve's recovery-code instructions.

Checking a retained backup#

For SDA, work on a copy of the entire maFiles folder. An unencrypted maFile can be read in a trusted local text editor; search for revocation_code. Not all exports contain it, and a file from an authenticator that was replaced may hold an obsolete code. See read, decrypt or import a maFile for the right branch.

For ODA, preserve the vault, recovery files and their passphrase. If the account is still accessible in the app, use its recovery-code controls rather than editing encrypted storage. A readable code in an old backup is not proof it still matches Steam. Do not upload the file or code to a decoder, chat or support form, including ours.

Using Steam's recovery-code route#

  1. Open Steam Support yourself.

    Choose Help, I can't sign in, then the lost or deleted mobile-authenticator option. Identify the account and complete the checks Steam offers for your situation.

  2. Choose the recovery-code option when offered.

    Enter the code only in Steam's own form. Read which account action you are confirming; the code does not skip the other ownership or access checks.

  3. Restore protection after recovery.

    If you removed the authenticator, set up the replacement and save its new recovery code. Keep a desktop backup separate from the machine and retain the passphrase needed to open it.

Removal has a cost: Valve applies a 15-day trade and Market restriction. If the task is moving to another phone and Steam offers a transfer, review that option first. A recovery code is not a way to bypass an existing restriction.

What the code can and cannot do#

Recovery code versus backup login code
The recovery code is used for authenticator removal. A backup login code is a one-use replacement for a login code. Valve documents generating backup codes under Account Details → Manage Steam Guard.
A new authenticator needs a new recovery code
After replacement or re-enrolment, retain the newly issued code. A copy of the previous one does not recover the new authenticator.
The code is sensitive, but not a normal sign-in credential
Steam's recovery process also checks access or ownership. A leaked code still compromises a recovery secret; review account security rather than assuming it is harmless.
No code and no usable device or backup
Check the linked-number route before using Steam Support. A third-party tool cannot reconstruct missing authenticator secrets from an account name. The lost-access guide keeps the recovery options in order.

Preserve the next code#

Open Desktop Authenticator asks you to record the recovery code and acknowledge it during setup. Complete that step and any encrypted recovery-backup retry. During a transfer, Steam has already replaced the authenticator when the new code is shown: saving it protects an account change that has already happened. Keep the code and backup accessible if the PC is lost, and update your records after replacing an authenticator.