No that’s the normal codes, which are time limited. A backup code could be 40 digits or something like that.

Most I've seen are 6 digits for both the TOTP and the recovery. Who is using 40 digits for an MFA recovery code?

Most services I use give several 6~8 digit recovery codes, I've never had discretion with them. I have no idea what they're talking about.

> Most services I use give several 6~8 digit recovery codes

Well RubyGems itself, subject of this post, has 12 for a start.

The most you've seen for a recovery code is 6 digits? Where have you seen these "never more than 6 digits" codes ?

GitHub's codes are 8 alphanumerics,

Dropbox 8 alphanumerics,

Live.com offers a 25 alphanumerics

Google 8 numeric

Facebook 8 numeric

Nintendo 8 numeric

Login.gov 12 alphanumerics

Gitlab 16 hexadecimal

I'm sure some fool somewhere used a six digit numeric "recovery code" but the usual, while it isn't 40 is certainly more than 6.

I must be mistaken, looks like 8, those are the sites I use.