Two-Factor Authentication for X: Frequently Asked Questions

Two-factor authentication (2FA) is a second lock on your X account. Many people know they should enable it but stall at "how, and what if I lose it". This FAQ set clears it up.

What 2FA actually is

It adds a check beyond your password: at login you also enter an SMS code or a time-based code from an authenticator app. Someone with only your password cannot get in, which stops most credential-stuffing and post-phishing takeovers.

Which to pick

Prefer an authenticator app (TOTP-based) or a hardware key; they are steadier than SMS. SMS can be intercepted by SIM-swap attacks, so do not rely on it alone. For setup, see backup codes and authenticator setup.

Lost your backup codes

Backup codes are one-time rescue codes. If lost, generate a new set and the old set is invalidated at once. Before generating, confirm you can still sign in another way, so you do not lock yourself out.

New phone

On the old phone, migrate the X entry in your authenticator to the new phone, then remove it from the old device. If the old phone is gone, sign in with a backup code and rebind the new authenticator.

What it protects, and what it does not

2FA protects against "logged in despite a leaked password". It does not protect you if you hand-type a code into a phishing page, so only ever enter codes on the X official site. If the account already looks wrong, start with hacked-account recovery steps and suspicious-login response. Back on the homepage, also run our on-device tool over high-risk old tweets; protect the account and the footprint together.

One last note: 2FA locks the account, not the footprint. Even a rock-solid account still leaves old high-risk tweets open to profiling. Run the on-device tool over those old posts too, and you protect both the account and the trail.