Instagram accounts are popular targets for hackers, scammers and people trying to take over usernames or business profiles. Two-factor authentication (2FA) adds a second layer of security: even if someone steals your password, they cannot log in without a code from your phone or authentication app. This guide explains how to turn on two-factor authentication on Instagram step by step, which method is safest and how to avoid getting locked out.
What is two-factor authentication?
Two-factor authentication requires two things to log in:
- Something you know: your password
- Something you have: a code from your phone, an app or a security key
| 2FA method | Security level | Notes |
|---|---|---|
| Authentication app | High | Codes from Google Authenticator, Microsoft Authenticator, Duo or similar apps |
| WhatsApp code | Medium | Codes sent through WhatsApp where available |
| SMS text message | Medium | Vulnerable to SIM swap attacks |
| Backup codes | Emergency access | Use if you lose your phone |
| Security key | Very high | Supported for some Meta accounts and devices |
An authentication app is the recommended option for most people.
How to turn on 2FA on Instagram (app)
Menu names may change slightly, but the process is generally:
- Open Instagram and go to your profile.
- Tap the menu (three lines) in the top right.
- Tap Accounts Center.
- Tap Password and security.
- Tap Two-factor authentication.
- Select your Instagram account.
- Choose Authentication app, WhatsApp or Text message (SMS).
- Follow the prompts to complete setup.
Setting up an authentication app
- Install an authenticator app such as Google Authenticator, Microsoft Authenticator or another trusted app.
- In Instagram 2FA settings, choose Authentication app.
- Instagram shows a setup key or opens the authenticator app.
- Add the account in the authenticator app.
- Enter the six-digit code from the app into Instagram to confirm.
Save your backup codes
After enabling 2FA, Instagram offers backup codes or recovery codes. Save them in a password manager or write them down and store them securely. Each code works once and helps if you lose your phone.
Frequently asked questions
Does 2FA mean I need a code every time?
Usually only on new devices or after logging out, not every time you open the app.
What if I lose my phone?
Use a backup code to log in, then set up 2FA again on your new phone.
How to turn on 2FA on Instagram from a computer
- Go to instagram.com and log in.
- Click More (three lines) in the bottom left, then Settings.
- Click Accounts Center.
- Choose Password and security, then Two-factor authentication.
- Select your account and preferred method.
- Follow the steps and save backup codes.
Why SMS 2FA is weaker
SMS codes are better than nothing, but criminals can use SIM swapping, convincing a phone carrier to move your number to their SIM card. Then they receive your codes. Authentication apps and security keys are not tied to your phone number, making them harder to steal. If you use SMS, add a carrier account PIN to reduce SIM swap risk.
Additional Instagram security settings
| Setting | Where to find it | Why it matters |
|---|---|---|
| Login alerts | Accounts Center, Password and security, Login alerts | Notifies you of new logins |
| Where you are logged in | Accounts Center, Password and security | Log out unknown devices |
| Strong unique password | Password and security, Change password | Prevents password reuse attacks |
| Security checkup | Password and security | Reviews your settings |
| Emails from Instagram | Password and security | Verify real Instagram emails |
| Private account | Account privacy | Limits who sees your content |
Instagram’s Emails from Instagram section shows recent official emails, helping you spot fake security emails.
Common Instagram scams to avoid
- Fake copyright or violation messages saying your account will be deleted unless you log in through a link
- Verification badge offers asking for payment or login details
- Friends asking for login codes: if a friend’s account was hacked, the scammer may ask you to send a code sent to your phone
- Brand collaboration scams with fake login pages
- Account recovery services promising to restore hacked accounts for money
Instagram will never ask for your password or 2FA code in a direct message. Never share codes with anyone.
What to do if you get locked out
| Situation | What to do |
|---|---|
| Lost phone with authenticator | Use backup codes |
| No backup codes | Use Instagram’s help options on the login screen, such as verifying your identity |
| Changed phone number | Log in with authenticator or backup codes, then update your number |
| Account hacked | Visit instagram.com/hacked from a device you used before |
To avoid lockouts, store backup codes safely and update 2FA settings when you switch phones. Many authenticator apps support cloud backup or transfer to a new phone.
Switching phones with 2FA
Before resetting or trading in your old phone:
- Install your authenticator app on the new phone.
- Transfer accounts using the app’s export or cloud backup feature, or reset 2FA in Instagram and set it up again.
- Test a login on the new phone.
- Then erase the old phone.
Many people get locked out because they reset the old phone first.
Two-factor authentication for business and creator accounts
Business and creator accounts are attractive targets because they have followers, ad accounts and brand value. Extra steps:
- Turn on 2FA for every person who manages the account
- Use Meta Business Suite to give team members their own access instead of sharing passwords
- Remove former employees and agencies promptly
- Turn on 2FA for linked Facebook accounts and Meta Business accounts
- Use a password manager to store recovery codes for the business
- Keep a record of who has access and when it was granted
Real examples
The creator. Maya, with 80,000 followers, received a fake copyright warning and almost clicked. She had 2FA with an authenticator app, so even when a friend fell for a similar scam, her account stayed safe.
The lost phone. Raj dropped his phone in a lake. Because he had saved backup codes in his password manager, he logged in on a new phone and reset 2FA in minutes.
The SIM swap. Lena’s phone number was hijacked in a SIM swap. Her Instagram used an authentication app, so the attacker could not get in. She reported the swap to her carrier immediately.
Frequently asked questions
Is 2FA free on Instagram?
Yes.
Can I use the same authenticator app for other accounts?
Yes. One authenticator app can store codes for email, banking, social media and more.
Can I turn off 2FA?
Yes, in the same settings, but it is not recommended.
Protect your email too
Your Instagram account is only as secure as the email address connected to it. If someone hacks your email, they can reset your Instagram password. Turn on 2FA for your email account as well, preferably with an authentication app or passkey, and review recovery phone numbers and backup emails.
Passkeys and the future of logins
Many services are moving toward passkeys, which use your device’s fingerprint, face or PIN instead of passwords. Passkeys resist phishing because there is no password to steal. Meta has introduced passkey support for some apps and devices. As support expands, enabling passkeys alongside 2FA will make accounts even harder to hijack.
Security checklist for Instagram
- Strong, unique password stored in a password manager
- Two-factor authentication using an authentication app
- Backup codes saved securely
- Login alerts turned on
- Unknown devices logged out
- Email account protected with 2FA
- Phone carrier account protected with a PIN
- Never share login codes or click suspicious links
See how to create a strong password and how to delete an Instagram account permanently for related guides.
Teaching teens about Instagram security
Teens are often targeted by account takeover scams. Parents can help by:
- Setting up 2FA together and explaining why it matters
- Storing backup codes in a family password manager
- Explaining that friends should never ask for login codes
- Using Instagram’s supervision tools where appropriate
- Encouraging teens to report suspicious messages instead of replying
A five-minute setup can prevent the stress of a hacked account and lost photos and memories.
Final thoughts
Turning on two-factor authentication is one of the most effective ways to protect your Instagram account. It takes only a few minutes in Accounts Center, and it stops most account takeovers even if your password is leaked. Choose an authentication app, save your backup codes and stay alert to phishing messages. For more account security tips, read how to know if your phone is hacked and how to recover a hacked Facebook account.
Quick setup summary
Profile, menu, Accounts Center, Password and security, Two-factor authentication, choose your account, select Authentication app, scan or enter the key, enter the six-digit code, save backup codes. That is all it takes to make your account dramatically harder to hack.
The bottom line
Turn on two-factor authentication on Instagram through Accounts Center, Password and security. Use an authentication app, save backup codes and never share login codes. Also read how to recover a hacked Facebook account.
2 thoughts on “How to Turn On Two-Factor Authentication on Instagram”