instagram 2fa · facebook two factor · backup codes · lost phone
Instagram 2FA, Facebook two factor, TikTok and X: how to turn the second step on And not lock yourself out
Instagram 2FA and Facebook two factor authentication do the same job: a login from a device the platform does not recognise needs a code as well as the password, so a stolen or guessed password stops being enough.
Reconstruction for explanation · not a real Instagram screen
Instagram calls it the single most effective step to protect an account from hackers. Pick the platform for the exact path — then save the backup codes, because they are what lets you in on the day the phone is gone.
Turn it on
Two-factor authentication on Instagram, Facebook, TikTok and X: the path on each
Menu names are the current ones from each platform's help. Meta is moving people to “Meta Account” settings, so on Instagram and Facebook you may see either Accounts Center or Meta Account as the place where these options live.
Instagram 2FA: three methods, one recommended
Instagram calls the authentication app the recommended method.
- In the app open Profile → Menu → Accounts Center → Password and security → Two-factor authentication and select the account.
- Choose the method: Authentication app (Instagram names Duo Mobile and Google Authenticator as examples), Text message, or WhatsApp. Follow the on-screen instructions.
- For text message you can use the mobile number already on the account or add a new one. WhatsApp becomes available after the text-message method is on.
- Open Additional methods → Backup codes and save the list before you close the screen.
- When you next log in with a code you can tap Trust this device, so that device is not asked again. Do it only on a phone or computer that is yours alone.
The limit The authentication app method can be turned on only in the Instagram app for Android or iPhone, not in a browser. Instagram's help lists no security key among its three methods. Threads has no separate switch: two-factor authentication is managed in Instagram and applies to both apps.
Where to keep the codesFacebook two factor: three methods and ten recovery codes
Once it is on, Facebook asks for a login code, or for a confirmation of the login attempt, each time someone tries to get in from a browser or mobile device it does not recognise.
- Click your profile picture, then Settings and privacy → Settings → Accounts Centre → Password and security → Two-factor authentication, and choose the account. You may be asked for the password again.
- Choose one of the three methods: tapping a security key on a compatible device, login codes from a third-party authentication app, or text message (SMS) codes.
- Under How you get login codes open Additional methods → Recovery codes → Get new codes. Ten codes appear; print them or write them down. Each works once.
- Facebook's help also suggests creating a passkey as an easier and more secure way to log in.
The limit Recovery codes exist only while two-factor authentication is on. Facebook offers to save the browser or device so that it is not asked for a code again — its help says to do that only on your own.
Where to keep the codesTikTok 2-step verification: choose at least two methods
TikTok's point: if someone obtains your password, they still need access to your phone or email to log in.
- In the app tap Profile → Menu ☰ → Settings and privacy → Security & permissions → 2-step verification.
- Choose at least two of: Phone, Email, Authenticator, Password.
- For Authenticator you need a third-party app; TikTok names Google Authenticator and Microsoft Authenticator. The set-up steps themselves are on the screen.
- Keep the recovery code you receive when you set up the authenticator: it is what resets the method if that app is ever lost.
The limit With 2-step verification on, a password reset from a device you have never used for TikTok is refused with an “unrecognized device” error. TikTok says this is deliberate: it stops others from resetting your password even if they have your email or phone number. Reset from a device you have used before.
TikTok recovery routesX: three methods, and a limit on text messages
help.x.com is closed to us by a bot check. This block follows the summary of X's help pages in search results and names no menu path — read the names in X's own help before you rely on them.
- Three methods are described: text message, authentication app, security key.
- Since 20 March 2023 the text-message method is not available to accounts without a Premium subscription; with Premium it depends on the country and the carrier.
- Backup codes: up to five can be active at once. They are meant to be used in the order they were generated — using one out of order makes the earlier ones invalid.
The limit Everything in this block is second-hand. The exact menu names, and what X offers when the second step cannot be completed, are on X's help page.
Open X's help pageLost the phone: what still lets you in
The second step is tied to a device or a number. What remains is what you prepared earlier — and after that, only the platform's own identity check.
- Instagram. Its help: “If you lose access to your phone or email address and are unable to get login codes, you can use a backup code to log in.” The codes can be taken only while logged in, so they must already be saved.
- Facebook. Enter one of the ten recovery codes you saved; each works once. They exist only if they were taken while two-factor authentication was on — what else Facebook offers at that screen, the help we read does not list, so we do not.
- TikTok. At the code prompt tap Can't access the app and enter the recovery code from the authenticator set-up. No code: Need more help? and an identity check — TikTok says this may take up to 30 days.
- The number is yours, only the handset is gone. Text-message codes follow the number: a replacement SIM from your carrier brings them back.
- Once you are in: add the new phone or a new method, take a fresh set of codes — the old set stops working — and look through the list of logged-in devices.
The limit No platform's help describes a way past the second step without the owner proving who they are. Someone who offers to “remove 2FA” for a fee, or asks you to forward a code “to verify”, fits the recovery scam Bitdefender describes: forwarding the code hands over the account.
How not to get hereMethods
Authentication app, SMS, security key, backup codes: what each method depends on
The method decides what you must still have in your hand on the day you log in from a new device.
| Method | Where it is offered | What it depends on | Its weak point |
|---|---|---|---|
| Authentication app | Instagram (recommended), Facebook, TikTok; X — per its help summary | The phone or phones where the app is set up | Codes are made on the device. Before you change phones, add the new device or have backup codes ready. |
| Text message (SMS) | Instagram, Facebook, TikTok (“Phone”); X — Premium accounts only, per its help summary | Your mobile number and the network | Lose the number and the method is gone with it. |
| The text-message method, turned on first | Not a separate start: Instagram adds it only on top of text message. | ||
| TikTok | The mailbox on the account | Only as strong as the mailbox. Give that mailbox its own password and its own second step. | |
| Security key | Facebook; X — per its help summary. Not among Instagram's three methods | A physical USB or NFC key that you tap or insert | One more object to keep safe. Pair it with saved recovery codes. |
| Backup or recovery codes | Instagram (backup codes), Facebook (10 recovery codes), X (up to five active, per its help summary); TikTok gives a recovery code with the authenticator | The place where you saved them | Worth nothing if the only copy is on the phone you lost. |
Which is stronger? Google's 2019 study of its own accounts, done with New York University and UC San Diego, found that an SMS code blocked 96% of bulk phishing and 76% of targeted attacks, and an on-device prompt 99% and 90%. These are Google's figures for Google accounts, not Instagram's or Facebook's: they show an order, not a promise.
Backup codes
Where to keep backup codes so they are there when the phone is not
A backup code is a second factor that does not need the phone. That is its whole use — and the reason not to keep the only copy on the phone.
- 1
Take them while you are logged in
Instagram: you must be logged in to see the list of backup codes or get a new one. Facebook: recovery codes can be taken only after two-factor authentication is on.
You should see: a list of codes for the account you selected.
- Instagram: Profile
- Menu
- Password and security
- Two-factor authentication
- account
- Additional methods
- Backup codes
- 2
Save them the way the platform itself suggests — and then move the copy
Instagram suggests copying the codes, taking a screenshot or saving them in some other way; Facebook says to print them or write them down. A screenshot left only in the phone's gallery is lost together with the phone, so put the copy somewhere else.
- 3
Paper or a password manager — not the mailbox behind the account
Paper kept at home works. So does a password manager: CISA recommends using one. The mailbox on the account is the wrong place — Instagram's own warning is that anyone who can read your email can probably also access your Instagram account, and then both factors sit behind one password.
- 4
A new set cancels the old one
On Instagram, Get new codes cancels the current codes. On Facebook each code works once; when they run out or are lost, Get new codes gives another ten. Replace the saved copy every time.
You should see: the copy you keep matches the newest set.
- 5
Never pass a code to another person
Not to a “support agent”, not to a friend's account that suddenly asks, not to a page reached by a link. A backup code is a way into the account for whoever types it.
What it changes
What a second factor stops — and what it does not
Four ordinary ways a password leaves its owner, and where the second step stands in each.
- 1
The password was typed into a fake login page
The page takes whatever is entered and passes it on. Trend Micro documented fake Instagram pages that ask for the username, the password and even the email password.
Where the owner stops it The login from the stranger's device still needs a code. Change the password anyway: it is known.
- 2
The same password leaked from another site
TikTok's help: bad actors often take leaked credentials from unrelated breaches and try them across different platforms.
Where the owner stops it A reused password alone no longer opens the account. Test an old password in the breach check.
- 3
The page or the “helper” asks for the code as well
This is the case the second step does not cover by itself. Bitdefender describes “recovery” profiles that send a fake login page and ask the owner to forward the code the platform has just sent.
Where the owner stops it A code is typed only into the app you opened yourself, or the site whose address you typed. It is never forwarded or read out.
- 4
A shared device was marked as trusted
A trusted device is not asked for a code again. On a shared phone or a public computer that means the next person is not asked either.
Where the owner stops it Instagram: do not tap Trust this device on a public or shared device. Facebook: do not save the browser on a public computer. Instagram's help says trusted devices can be removed once two-factor authentication is on.
A second factor protects the login. It does not protect the mailbox behind the account — give the mailbox its own.
Before the phone changes
Before you change, sell or reset a phone
A two-factor lockout needs no attacker: it is enough that the phone was replaced, reset or lost while the only method was on it. Everything below is done while you are still logged in — which is the one moment when it is easy.
- Have more than one way in. TikTok requires at least two methods. On Instagram and Facebook, add a second method next to the first and save the backup or recovery codes.
- Take the codes now. Instagram's backup codes and Facebook's recovery codes are issued only to a logged-in owner.
- Set up the new phone before wiping the old one. Log in on the new phone, add it as a method, check that a code from it is accepted — then reset the old phone.
- Changing the number? Change it in the two-factor settings first. A text-message code goes to the number on the account, whoever holds that number now.
- Check what is trusted. After you turn two-factor authentication on, Instagram lets you see login requests and remove trusted devices. Remove the phone you are giving away.
Questions
Instagram 2FA and Facebook two factor: short answers
The Instagram 2FA code is not coming. What now?
Instagram's help covers exactly this: if a code cannot be sent because of connectivity or delivery problems, you can complete the login with a backup code. On Facebook, use one of the recovery codes you saved.
Can I turn on Instagram 2FA without a phone number?
The authentication app is one of Instagram's three methods and the one it recommends; the codes come from the app, not by text message. It can be turned on only from the Instagram app for Android or iPhone.
Is two-factor authentication on Threads separate?
No. Password, two-factor authentication and saved login are managed in Instagram and apply to both apps. Turn it on in Instagram.
Should I turn 2FA off before changing phones?
There is no need. Add the new phone or a new method while you are logged in, check that it works, and only then reset the old phone. Facebook's help notes that Meta recommends keeping two-factor authentication on.
With 2FA on, does the password still matter?
Yes, but the bar is different. NIST's 2025 guidance sets a minimum of 15 characters for a password used on its own and 8 where the password is only one part of a multi-factor login. Either way: one password per account.
Someone says they can switch off 2FA on an account for me. Is that possible?
No help page we read describes a way to remove the second step without the owner logging in or proving identity to the platform. Offers of this kind end with a request for money, for your login on their page, or for the code you have just received.
Take it with you
Save this page as your own plan
Print the page or save it as a PDF to keep the steps next to your phone while you go through the settings.
- The printout opens every route and every answer on this page in full
- The file is made by your own browser — nothing is uploaded
- This site does not log in to anyone's account and asks for no username