Short answer: To set up 2FA on X, go to Settings and privacy → Security and account access → Security → Two-factor authentication and tick Authentication app. Enter your password, scan the QR code, confirm the six-digit code, and save the backup code X shows you. SMS 2FA on X is reserved for paid subscribers — which is fine, because you should not be using it anyway.
The one thing that makes X different
In 2023, X removed SMS two-factor authentication for free accounts. A lot of people had their 2FA switched off automatically as a result and never turned it back on. If you have not touched your security settings since then, there is a real chance your account currently has no second factor at all.
That is worth two minutes to check. X accounts are heavily targeted for crypto scam takeovers — an established account with real followers posting a fake giveaway converts far better than a new one, which is exactly why yours has resale value even if you think it doesn’t.
Step 1: Open two-factor settings
- Click More (the ⋯ icon) in the sidebar, then Settings and privacy. On mobile, tap your profile picture → Settings and privacy.
- Select Security and account access.
- Tap Security.
- Tap Two-factor authentication.
You will see three checkboxes: Text message, Authentication app, and Security key. Note that these are checkboxes, not radio buttons — you can and should enable more than one.
Step 2: Enable the authentication app
- Tick Authentication app.
- Enter your account password when prompted.
- Tap Get started. X displays a QR code.
- Scan it with your authenticator app. If you are on the same device, use the link beneath the code to reveal the text key and paste it into your app manually.
- Enter the six digits your app generates and confirm.
Do not screenshot the QR code. It contains the raw secret key — anyone with that image can generate valid codes for your account indefinitely, and screenshots have a habit of syncing to cloud photo libraries. If you want a copy on a backup device, scan the same code twice while it is still displayed.
Any standard app works here: Google Authenticator, Authy, Microsoft Authenticator, Aegis, 2FAS, or a password manager with TOTP built in. If you are still choosing, see Authy vs Google Authenticator and our roundup of the best authenticator apps.
Step 3: Save the backup code
Once 2FA is on, X generates a single backup code, found under Two-factor authentication → Backup codes. Unlike Google or GitHub, which hand you ten, X gives you one at a time — you can regenerate it, which invalidates the previous one.
Write it down somewhere offline or store it in an encrypted vault. Not your camera roll, not a DM to yourself. Our guide on where to store 2FA backup codes covers the practical options.
Account recovery on X without a code is slow and heavily automated. Losing your phone without a saved backup code can mean losing the handle — our walkthrough on recovering accounts after a lost 2FA phone is worth reading before you need it.
Step 4: Consider a security key
X supports FIDO2 security keys, and this is the strongest option available on the platform. A hardware key is bound to x.com by the browser, so it will not authenticate on a lookalike phishing domain — which matters, because phishing is how large accounts are actually stolen, not password guessing.
If you run a brand, news or crypto-adjacent account, a key is a sensible investment. Buy two and register both, so losing one is not a catastrophe. See what a hardware security key is and YubiKey vs passkeys.
Step 5: Turn on additional password protection
Back under Security, there is a setting called Additional password protection (sometimes labelled “Password reset protect”). Switch it on.
It requires your email address or phone number before a password reset can proceed. Without it, a password reset request only needs your username — which is public. This one toggle blocks a whole category of casual takeover attempts and almost nobody enables it.
Step 6: Audit apps and sessions
Two more pages worth visiting under Security and account access:
- Apps and sessions — review every logged-in device and every connected third-party app. Old scheduling tools, analytics services and games often hold write access to your account. Revoke anything you do not actively use.
- Connected accounts — check which Google or Apple accounts can sign in as you. If someone controls that account, 2FA on X may not be the barrier you think it is.
Compromised third-party apps have been the source of several mass “hacked tweet” incidents. Your own 2FA is irrelevant if a posting tool you authorised in 2019 gets breached.
Frequently asked questions
Why can’t I use SMS 2FA on X?
X restricted text-message 2FA to paid subscribers in 2023. It is not a loss — SMS codes are vulnerable to SIM swap attacks, where an attacker takes over your phone number at the carrier. An authenticator app is both free and safer. See SMS 2FA vs authenticator apps.
Did X turn off my 2FA without telling me?
If your only method was SMS and you were on a free account, yes — it was disabled during that transition. Check the two-factor page now; a surprising number of accounts have been running unprotected since.
Can I use Google Authenticator with X?
Yes. X uses standard TOTP, so any authenticator app works. Our explainer on how TOTP codes work covers why they are interchangeable.
Why is X rejecting my authenticator code?
Almost always clock drift — your phone’s time has fallen out of sync. Enable automatic network time in your date and time settings. See why 2FA codes get rejected for the rest.
What is a temporary password on X?
Some third-party apps that do not support 2FA need a one-time password instead of your real one. X can generate one under two-factor settings. Use it sparingly and prefer apps that support proper OAuth authorisation.
Does 2FA stop my account being suspended or impersonated?
No. 2FA protects against unauthorised logins. Impersonation accounts and moderation decisions are separate issues handled through reporting.
The bottom line
X is the platform where the largest number of people quietly lost their second factor without noticing. Open the settings, confirm an authenticator app is ticked, save the backup code, switch on additional password protection, and clear out third-party apps you forgot you authorised. Ten minutes total, and it covers the three ways X accounts are actually taken over.
Want to verify your codes are generating correctly? Our free online 2FA code generator works entirely in your browser.
One Response