How to turn on two-factor authentication (2FA) on Instagram
To turn on two-step (two-factor) authentication on Instagram, open your profile, tap the menu icon, go to Accounts Center, then Password and security, then Two-factor authentication, pick your Instagram account and choose a method: an authentication app, text message (SMS) or WhatsApp. Confirm the six-digit code Instagram shows or sends, then save your backup codes so you can still log in if you lose your phone.
This guide covers the setup on Android, iPhone and the web, which 2FA method to choose, how backup codes work, and how to turn the feature off again.
What two-factor authentication does on Instagram
Instagram two-factor authentication (2FA) adds a second check to the login: after your password, Instagram asks for a code or confirmation from something you have, such as your phone. Instagram calls the feature two-factor authentication; many people search for it as two-step authentication, two-step verification or 2FA, and all three mean the same setting.
The code is requested when you log in from a device or browser Instagram does not recognize. Someone who has stolen or guessed your password still cannot get into the account without that second factor. A phished or reused password is a common way into social media accounts, and it is exactly the case 2FA blocks.
Instagram 2FA is now managed in Meta Accounts Center. If your Instagram and Facebook accounts are linked in Accounts Center, you can protect both from the same screen.
How to turn on 2FA in the Instagram app
You turn on 2FA in the Instagram app through Accounts Center in a few taps. The path on Android is:
- Open Instagram and tap your profile picture in the bottom right.
- Tap the menu icon (three horizontal lines) in the top right.
- Tap Accounts Center.
- Tap Password and security, then Two-factor authentication.
- Select your Instagram account.
- Choose a method (authentication app, text message or WhatsApp) and follow the prompts.
On iPhone and iPad the steps are the same up to the menu icon. Depending on your app version you reach the setting through Settings, Security, Two-factor authentication and the Get Started button, or through Accounts Center, Password and security. Both lead to the same method choice.
Instagram then asks you to confirm the method: enter the code from your authenticator app, or the six-digit code that arrives by SMS or WhatsApp. If you have not added a phone number yet, Instagram asks you to add and verify one when you pick SMS.
How to turn on Instagram 2FA on the web
You can also turn on Instagram 2FA from a desktop browser at instagram.com. Log in, open the menu (three lines, bottom left), choose Settings, then See more in Accounts Center. From there:
- Click Password and security.
- Click Two-factor authentication and choose your Instagram account.
- Pick a method and follow the on-screen prompts.
Setting up an authenticator app from the browser is convenient: Instagram shows a QR code on the large screen, and you scan it with the app on your phone. If you cannot scan the code, copy the setup key into the app instead.
Which Instagram 2FA method should you choose?
An authentication app is the best Instagram 2FA method for most people, and it is the option security guides recommend. The app generates codes on your phone without a network, so codes cannot be intercepted on the way and do not depend on your mobile carrier.
| Method | How you get the code | Main weakness |
|---|---|---|
| Authentication app | Generated offline in an app such as Google Authenticator or Duo Mobile | Codes are lost with the phone unless the app backs them up |
| Text message (SMS) | Six-digit code sent to your phone number | Vulnerable to SIM swapping and delayed or missing texts |
| Code delivered to your WhatsApp number | Requires text message security to be set up first | |
| Security key | Physical key you tap or plug in, where offered | Not shown on every device or account |
A practical setup is an authenticator app as the main method and SMS as a fallback. If you already use a password manager with a built-in authenticator, you can keep Instagram codes there; the Bitwarden Authenticator import feature shows how codes move between apps when you switch.
Instagram backup codes: how to get and use them
Instagram backup codes are one-time login codes that let you sign in when you cannot receive your normal 2FA code, for example after losing or resetting your phone. Save them as soon as 2FA is on.
To view them in the app, go to Accounts Center, Password and security, Two-factor authentication, select your account, then Additional methods and Backup codes. On the web, the path is the same once you open Accounts Center from Settings. Select Get new codes to create a fresh set; this replaces the old list, so only the newest codes work.
Store the codes outside your phone: in a password manager, on paper in a safe place, or both. Each code works once, so cross off a code after you use it. If you get locked out without codes, the official recovery path is in our guide to fixing Instagram password reset problems.
How to turn off two-factor authentication on Instagram
You turn off Instagram 2FA from the same Accounts Center screen you used to set it up: Password and security, Two-factor authentication, then select your account and switch off the methods you added. You need to be logged in to the account to do this.
Before you disable it, consider switching methods instead. If SMS codes stopped arriving after a number change, add an authentication app and remove the old phone number. Turning 2FA off leaves the account protected by the password alone, which is the weakest state for an account people want to hijack.
FAQ
Is two-step verification the same as two-factor authentication on Instagram?
Yes. Instagram only has one feature, called two-factor authentication. Two-step verification, two-step authentication and 2FA are other names for the same setting in Accounts Center.
Does Instagram ask for a 2FA code every time I log in?
No. Instagram asks for the code when you log in from a device or browser it does not recognize. Devices you have already confirmed normally stay logged in without a new code.
Can I use Instagram 2FA without a phone number?
Yes, if you choose an authentication app. The app generates the codes itself, so Instagram does not need your phone number for that method.
What if my 2FA code is not arriving?
Check that the phone number in Accounts Center is current and that the device has signal, or use a saved backup code instead. Switching to an authentication app avoids SMS delivery problems for future logins.
Related: Meta passkeys on Facebook, how to hide your Instagram account, Instagram password reset not working
Leave a Reply