Steam recovery code: what the R-code does

It looks like R12345. Valve calls it your recovery code; SDA and every maFile call the same thing revocation_code. It is the difference between fixing a lost authenticator in five minutes and spending days proving your identity to Steam Support.

What it actually does

The recovery code detaches the authenticator from your account without the device the authenticator is on. Dead phone, wiped disk, stolen laptop — it proves something you knew rather than something you hold, which is why it survives losing the hardware.

It is not a master key on its own, and it is worth being exact about that. Removal happens inside an authenticated Steam session — you go through Steam's recovery pages as the account owner and supply the code there. Steam's own API works the same way: the removal call takes an access token and the code. So the code is one of two things a removal needs, not the whole of it. It also has no other power: it does not generate codes and it cannot approve a trade.

Where to find yours

It is shown once when the authenticator is created, and most people never look at it again — but it is not gone if you still have a working authenticator. Valve's answer to "I didn't save my recovery code" is direct:

So the honest framing is: it is displayed once unprompted, and available on demand for as long as the authenticator still works. The moment it becomes unrecoverable is the moment you lose access — which is precisely when you need it. Look it up now rather than later.

Other places a copy may survive:

• Inside a maFile. If the authenticator was ever held by a desktop tool, the file carries a revocation_code field. Any surviving copy — an old machine, an old backup — carries it too.
• Screenshots and notes. The setup screen told you to save it, and plenty of people screenshotted it. Search your images and your password manager for anything starting with R.

Using it

Steam's help pages, under the option for no longer having access to your authenticator — enter the code and the authenticator is removed; then set up a fresh one. Removing an authenticator carries a fifteen-day trade and Market restriction, which is why transferring is the better path when you still can. Nothing legitimate bypasses it.

Keeping the next one

Write it on paper, keep the paper somewhere the device is not, and check it is still readable when you think of it. A code stored only on the device it revokes is not a backup — losing the device loses both at once.

This is also somewhere software can refuse to let you fail. When Open Desktop Authenticator creates an authenticator it does not treat the account as active until the code has been shown and you have confirmed it is written down — at the one moment the code exists and nothing is yet at risk. That ceremony exists because every horror story on the lost-access page begins with "I never wrote it down".

Related

• Lost access, in recovery order
• Moving to a new phone
• What else a maFile holds