Skip to main content
zerotal

Documentation

Documentation / @zerotal/auth / RECOVERY_CODE_BITS

Variable: RECOVERY_CODE_BITS

const RECOVERY_CODE_BITS: 160 = 160

Defined in: auth/src/TwoFactorService.ts:130

Entropy per recovery code, in bits.

Recovery codes are stored under a single unsalted SHA-256, which is only defensible because the search space is this large: 2^160 leaves an offline attacker with a leaked column nothing to do. Lowering this without also changing the storage scheme turns every recovery code into a brute-forceable second-factor bypass.