How to Set Up Two-Factor Authentication on Instagram

Instagram accounts are attractive targets. Even a small personal profile holds private messages, photos, and contacts, and a compromised account can be used to message your friends with scams in your name. Two-factor authentication makes that much harder: someone who learns your password still cannot log in without a second code that only you can produce.

This guide explains where to find the setting, which method to pick, how to save your setup key and backup codes, and what to do if you ever get locked out. Instagram has moved its security settings into Meta's Accounts Center, and the app changes regularly, so menu names may vary slightly by version and region.

Before you begin

• Make sure you can log in to Instagram normally and know your current password.
• Check that the email address and phone number on your account are current. They matter for recovery.
• Install an authenticator app if you plan to use one (recommended). Any standard TOTP app works.
• Turn on automatic date and time on your phone, since authenticator codes depend on an accurate clock.
• Have a secure place ready for backup codes, such as a password manager.

Where to find two-factor authentication on Instagram

In the mobile app, the path generally looks like this:

1. Go to your profile and open the menu (the three-line icon).
2. Open Accounts Center. On some versions you reach it through Settings first.
3. Select Password and security.
4. Select Two-factor authentication.
5. Choose the Instagram account you want to protect, if you have several linked in Accounts Center.

On the web, you can reach the same Accounts Center pages from Instagram's settings. Instagram may ask you to re-enter your password before showing security options.

Choosing a method: authentication app, SMS, or WhatsApp

Instagram typically offers a few ways to receive your second factor. Not every option is available in every country or on every account.

An authentication app is the better default. SMS and WhatsApp both depend on your phone number, and phone numbers can be hijacked through a carrier or lost when you change plans or travel. You can usually add SMS or WhatsApp as an additional method after setting up the app.

Setting up an authentication app

1. On the two-factor screen, choose Authentication app and continue.
2. If you have an authenticator installed on the same phone, Instagram may offer to open it automatically and add the account for you.
3. If not, or if you prefer to use a different device, Instagram shows a QR code or a setup key. Look for an option to set up on another device or to copy the key.
4. Scan the QR code with your authenticator app, or choose manual entry in the app and paste the key. Make sure the code type is time-based.
5. Return to Instagram and enter the 6-digit code your app now shows.
6. Confirm to finish. Instagram will then show you backup codes.

Save the setup key while you have it

The setup key is a string of letters and digits. It is the secret your authenticator uses to calculate every future code, and Instagram generally shows it only during setup. If you save it securely now, you can restore your codes on a new phone later without going through recovery.

• Store it in a password manager or another encrypted place, labelled with your Instagram username.
• Do not keep it as a plain screenshot or in an unencrypted notes app that syncs everywhere.
• Never share it with anyone, including people who say they are from Instagram support.

If you manage codes for several of your own accounts, an encrypted store such as a 2FA vault lets you keep keys in one place and see current codes without unlocking your phone, but a good password manager works for this too. What matters is that the key is encrypted and backed up somewhere other than a single phone.

Backup codes

After you enable two-factor authentication, Instagram provides a set of backup codes. Each code works once and lets you log in when you cannot get a code from your usual method, for example if your phone is lost or broken.

• Save them right away, either by copying them into a password manager or writing them down and storing the paper safely.
• Keep them away from your phone. Codes stored only on the phone you lost do not help.
• You can usually view or generate new backup codes later from the same two-factor authentication screen. Generating new codes typically replaces the old ones.

Login requests and trusted devices

With two-factor authentication on, Instagram may ask for a code when you log in from a new phone, browser, or location. On devices you already use, Instagram may remember the device so you are not asked every time.

You may also see login requests: a notification on a device where you are already logged in, asking whether a new login attempt was you. These are useful, but treat them carefully.

• Approve only logins you started yourself, a few seconds earlier.
• If you did not try to log in, deny the request and change your password. Someone has your password.
• Review where you are logged in from the security section of Accounts Center, and log out of any device or session you do not recognise.

Common setup problems

The code from the authenticator is not accepted

Check that your phone is set to automatic date and time. Codes are based on the current time, and a clock that is a minute or two off will produce codes Instagram rejects. Also make sure you are reading the entry for the correct Instagram account if your app holds several.

You do not receive the SMS or WhatsApp code

Wait a minute before requesting another, check signal or data, and confirm the phone number on your account is correct. Repeated requests in quick succession can be temporarily rate limited.

You are moving to a new phone

Transfer your authenticator entries before resetting the old phone, using your app's export or transfer feature. If you saved the setup key, you can add it to the new phone directly. Alternatively, while still logged in, go back to the two-factor settings and set up the authentication app again on the new device.

What to do if you are locked out

Work through these in order:

1. Use a backup code. On the screen asking for your code, look for an option such as "Try another way" or "Use a backup code".
2. Use another method you added. If you also set up SMS or WhatsApp, request a code that way.
3. Approve from a logged-in device. If you are still logged in on another phone or browser, you may be able to approve the login or change settings from there.
4. Use Instagram's official recovery flow. From the login screen, follow the help options for people who cannot access their codes or think their account was hacked. Instagram may ask you to confirm your identity, and the steps differ by account and region.

Only use Instagram's own app or help pages. Accounts that message you offering to "recover" your profile for a fee are scams, and real Instagram staff will never ask for your password, setup key, or backup codes.

FAQ

Can I use the same authenticator app for Instagram and Facebook?

Yes. A standard authenticator app can hold separate entries for each account. Depending on how your accounts are linked in Accounts Center, two-factor settings may be managed per account, so check each one.

Is WhatsApp safer than SMS for Instagram codes?

It avoids some problems with plain text messages, but it still depends on your phone number and WhatsApp account. An authentication app remains the stronger choice when it is available.

Will turning on two-factor authentication log me out everywhere?

Usually not. Existing sessions generally stay logged in. New logins will ask for a code. If you suspect someone else has access, log out of unfamiliar sessions manually and change your password.

I lost my backup codes. What now?

If you can still log in, go to the two-factor authentication settings and generate a new set. The old codes should stop working, so save the new ones somewhere safe straight away.