How do I turn on 2FA for Instagram?
By Bridget · Updated May 2026 · Reviewed by Locket Security Team
★ the short answer
To turn on 2FA for Instagram, go to Settings → Accounts Center → Password and security → Two-factor authentication, pick your account, and choose Authentication app (safer than SMS). Scan the code with an authenticator app, confirm the 6-digit code, and save your backup codes somewhere offline.
Where is the two-factor authentication setting on Instagram?
In the Instagram app, tap your profile → the menu (☰) → Settings and privacy → Accounts Center → Password and security → Two-factor authentication. Instagram now manages this through Meta's Accounts Center, so the setting may sit alongside your linked Facebook account.
Which 2FA method should I choose on Instagram?
Choose Authentication app over SMS. An authenticator app generates codes on your device and can't be intercepted by a SIM-swap attack the way text messages can. WhatsApp and SMS are offered as fallbacks, but an app like Google Authenticator, Authy, or your password manager is the most secure option.
How do I save my Instagram backup codes?
After enabling 2FA, Instagram shows a list of one-time backup codes. Screenshot or copy them into your password manager, or print them. These let you log in if you ever lose your phone. Without them, losing your authenticator device can mean a slow identity-verification recovery.
★ quick steps
Turn on two-factor authentication for Instagram
- 1
Profile → menu → Settings and privacy → Accounts Center → Password and security → Two-factor authentication.
- 2
Select the authenticator-app method rather than SMS.
- 3
Scan the QR code with your authenticator app and enter the 6-digit code to confirm.
- 4
Copy the backup codes into your password manager or print them.
Frequently asked
- It's far better than nothing, but an authenticator app is safer. SMS codes can be stolen through SIM-swap attacks, where a scammer ports your number. If you can, use an authenticator app and keep SMS only as a backup.
- It blocks the most common attack — someone logging in with a stolen or guessed password. It doesn't stop session-token theft from malware, so pair 2FA with cautious link-clicking and a password manager.
Sources
Want a human in your corner?
Locket Security helps creators recover, lock down, and protect every account they monetize — without the enterprise jargon.
See how Locket helps ★Keep reading
How do I recover a hacked Instagram account?
A creator's step-by-step plan to get a hacked Instagram account back — what to do in the first hour, the exact forms to file, and how to lock down everything attached to it.
Is an authenticator app safer than SMS codes?
SMS 2FA is better than nothing, but it has a real weakness: SIM swaps. Here's why an authenticator app or passkey is the safer choice.
How do I lock down my Instagram account?
A run-through of every Instagram security setting that matters for creators — do these once and you've closed the doors most takeovers walk through.