Short answer: To set up 2FA on Facebook, open Settings & privacy → Settings → Accounts Centre → Password and security → Two-factor authentication, pick your account, and choose Authentication app. Scan the QR code with your authenticator, enter the six digits to confirm, then save your recovery codes. Facebook now manages this through Accounts Centre, so the same setting can cover Instagram too.
Why Facebook is a bigger target than people assume
A Facebook account is not just photos. It is often the login for dozens of third-party apps and services, it holds payment details on Marketplace, and it carries your reputation with everyone you know. Compromised accounts are routinely used to run scams against the victim’s own friends — which is precisely why they are valuable to steal.
Business accounts are worse. Access to a Page or Ad Account can mean thousands in fraudulent ad spend on your card before anyone notices.
Step 1: Find the setting
Facebook has moved this menu several times, which is why old guides send you in circles. As of 2026:
- Tap your profile picture → Settings & privacy → Settings.
- Open Accounts Centre near the top.
- Select Password and security.
- Tap Two-factor authentication.
- Choose which account to secure.
On desktop the path is similar — Settings & privacy → Settings → Accounts Centre.
Step 2: Choose an authentication app
Facebook offers three methods. Pick the app.
- Authentication app — codes generated offline on your device. Recommended.
- Security key — the strongest option, and worth it if you run a business Page. See our guide to hardware security keys.
- SMS — avoid where you can. Vulnerable to SIM swapping.
Select Authentication app. Facebook shows a QR code and a text key beneath it.
Step 3: Scan and confirm
- Open your authenticator app and add a new account.
- Scan the QR code. If you are setting this up on the same phone, copy the text key and paste it into the app instead.
- Enter the six-digit code Facebook asks for.
Do not screenshot the QR code. It contains your raw secret key — anyone with that image can generate your codes indefinitely. If you want a spare, scan the same code into a second app while it is on screen.
If you have not chosen an app yet, our Authy vs Google Authenticator comparison covers backup and portability.
Step 4: Save your recovery codes
Under two-factor settings, find Recovery codes and generate a set. Each works once in place of an authenticator code.
Store them offline or in an encrypted password manager — not in your camera roll and not in Messenger. Our guide on where to store 2FA backup codes ranks the options.
Facebook account recovery without codes is notoriously slow, and support is largely automated. These codes may be the difference between a five-minute fix and losing the account permanently.
Step 5: Turn on login alerts and audit sessions
Still under Password and security:
- Login alerts — get notified when someone signs in from an unrecognised device.
- Where you’re logged in — review every active session and end anything you do not recognise.
- Apps and websites — revoke third-party apps you no longer use. Old integrations with broad permissions are a common blind spot.
If you run a Page, also check Page roles and remove anyone who no longer needs admin access.
Step 6: Remove SMS
If a phone number remains enabled as a two-factor method, an attacker who hijacks your number bypasses your authenticator entirely. Your protection is set by the weakest method you leave switched on, not the strongest.
Remove it once your app is confirmed working and your recovery codes are saved. The reasoning is laid out in our SMS vs authenticator app comparison.
Frequently asked questions
Does this also protect my Instagram?
If your accounts are linked in Accounts Centre, you can enable two-factor authentication for both from the same screen — but you must switch it on for each account individually. Enabling it on Facebook does not automatically apply it to Instagram.
What if I lose my phone?
Use a recovery code, or an already-logged-in device. Facebook may also let you verify through trusted contacts or ID upload. Our guide on recovering accounts after losing a 2FA phone covers the process.
Can I use Google Authenticator with Facebook?
Yes. Facebook supports any standard TOTP app — Google Authenticator, Authy, Microsoft Authenticator, Aegis, 2FAS, or a password manager with TOTP built in.
Why does Facebook say my code is invalid?
Usually clock drift on your phone. Enable automatic network time in your date and time settings. See why 2FA codes get rejected for the other causes.
Will 2FA log me out of my devices?
No. Existing sessions stay active. You will only be asked for a code on new logins.
Can I use Facebook’s own code generator?
The Facebook app includes a built-in code generator, which works — but it only covers Facebook. A standalone authenticator handles all your accounts in one place.
The bottom line
Five minutes of setup protects an account that quietly holds your identity, your contacts, and often your card details. Do the whole sequence in one sitting — app, recovery codes, SMS removed — because the half-finished version leaves the door you meant to close still open.