Instagram Two-Factor Authentication: Setup and Backup Codes

To turn on Instagram two-factor authentication, open your profile menu, go to Accounts Center, then Password and security, then Two-factor authentication, pick your account and choose an authentication app or text message codes. Then save your backup codes outside your phone, because they are what get you back in if that phone is lost, reset or stolen.

Steps checked October 2026 against Instagram's Help Center on securing your account with two-factor authentication, using an authentication app, SMS codes and backup codes. Instagram is gradually moving people to Meta Account settings, so some accounts see that label instead of Accounts Center.

Two-factor authentication (2FA) means a stolen password alone is not enough to log in: the attacker also needs a code from something you have. It makes a leaked or reused password far less useful to an attacker, which is how many accounts are taken over. Turning it on takes a few minutes, and day to day you mostly see a code prompt when you log in somewhere new. The part most guides skip, and most locked-out creators regret, is planning for the day the phone is gone. For restrictions, bans and other account problems, start at our Instagram account help hub.

Instagram two-factor authentication methods: which to choose

Instagram's SMS help page explains that when you turn on 2FA you choose either text message codes or a third-party authentication app as your primary method. An authentication app is the stronger choice. CISA, the US cybersecurity agency, tells people to migrate away from SMS-based multifactor authentication because text messages are not encrypted, and it lists SIM swapping as a way attackers capture SMS codes (both checked October 2026).

Before you turn it on

Instagram 2FA setup with an authentication app

If you use more than one phone or a tablet, Instagram's help page on 2FA for multiple devices explains that accounts using an authentication app can connect additional devices, each with an authentication app installed, after the first device is set up.

Instagram 2FA setup with SMS or WhatsApp

The path is the same: Accounts Center, Password and security, Two-factor authentication, choose the account, then SMS or WhatsApp. Instagram's help center notes you need a confirmed phone number on the account to use text message codes, and the number you enter becomes the account's confirmed number. Use this if an authentication app is not an option, and consider adding an authentication app later as the primary method.

Backup codes: the step that saves you

Backup codes are one-time codes that work when you cannot receive a login code. Instagram's backup code page places them under Accounts Center, Password and security, Two-factor authentication, your account, Additional methods, Backup codes. Choosing Get new codes cancels the old set.

If you are locked out

Instagram's login help pages cover losing access to the email or phone linked to the account, and explain why Instagram may ask for a video selfie to confirm your identity. That route works for many people but takes time and is not certain, so treat it as the last resort it is. If your account was taken over rather than just locked, the steps differ; the account help hub covers hacked and restricted accounts.

What 2FA does not protect against

Two-factor authentication stops the most common takeover: someone who has your password from a leak or a reused login. It does not make an account untouchable, and knowing the gaps keeps you from a false sense of safety.

• Fake login pages. A convincing copy of the Instagram login screen can ask for your password and then your 2FA code, and use both straight away. Only enter codes into the Instagram app or instagram.com, never into a page you reached from a message or email link.
• Sharing codes. Nobody legitimate needs your login code or backup codes. Messages claiming to be from Instagram, a brand partner or a "verification team" that ask for a code are attempts to take the account.
• Apps you already authorized. Third-party apps you logged into keep their access. Review them in your settings and remove anything you no longer use.
• A compromised email account. If someone controls your email, they can attack your Instagram recovery route. Turn on 2FA for the email account too.

A ten-minute security review, twice a year

Security settings drift. Phones change, team members leave, numbers get recycled. Put a reminder in your calendar and run through this short review:

1. Confirm 2FA is still on, and that the method is the one you expect.
2. Open your authentication app and check the Instagram entry is there and working.
3. Check the email address and phone number on the account are current.
4. Check your stored backup codes are where you think they are; generate a new set if any were used.
5. Review logged-in devices and authorized apps, and remove anything unfamiliar.
6. For business accounts, review who has access and remove people who no longer work with you.

If you manage several accounts, keep a simple record of which method and which backup-code location each account uses. When something goes wrong at a bad moment, you will not have to remember it under pressure.

Ten minutes twice a year is a small price for an account that represents months or years of work.

2FA for creator and business accounts

Accounts that earn money need stricter habits. Turn on 2FA with an authentication app, keep backup codes where the owner, not a freelancer, controls them, and review which devices and apps are logged in. When a team posts for you, give access through Instagram's own tools instead of sharing the password and codes, so removing someone does not mean resetting everything. If you are building or rebuilding an account, our Instagram Ignited program covers the full growth system; security is the part that protects it.

Security also affects how you grow. Third-party growth tools that ask for your password are a common route to a compromised account; our guide to growing an account without showing your face and the Instagram algorithm guide cover growth that needs no third-party login.

Troubleshooting

• Authentication app codes rejected. Check the phone's date and time are set automatically; app codes depend on the clock.
• No SMS arriving. Check signal and that the confirmed number is current, or switch to WhatsApp or the app method.
• New phone. Move your authentication app accounts before wiping the old phone, or use a backup code and set up the app again.
• Codes arrive but login still fails. You may be entering a code for a different account in the same authentication app. Check the account name above the code before typing it.
• Changing phone numbers. Update the confirmed number in Accounts Center before the old number is disconnected, especially if SMS is your only method. Recycled numbers can end up with someone else.
• Backup codes lost. While you are still logged in, generate a new set; the old set stops working.

Instagram two-factor authentication: FAQ