Short answer: To set up 2FA on LinkedIn, click your profile photo → Settings & Privacy → Sign in & security → Two-step verification → Set up, then choose Authenticator app rather than phone number. Enter your password, scan the QR code, confirm the six digits, and save the recovery code LinkedIn shows you — it appears once.
Why LinkedIn deserves more attention than it gets
LinkedIn is the account people secure last and regret first. It has no photos, no card details and no crypto, so it feels low-stakes — right up until it isn’t.
The value to an attacker is your credibility. A hijacked account with a real job history and real connections is a superb platform for targeted phishing: fake recruiter messages, malicious “job description” attachments, and business email compromise groundwork against your employer. Recruiters and salespeople are hit hardest because they message strangers all day, so nothing looks unusual. The same reputational risk applies to your other public profiles — see our guide to setting up 2FA on X (Twitter).
The recovery problem compounds it. LinkedIn’s support is slow and largely automated, and attackers routinely change the account email immediately, cutting off your reset path. A wave of takeovers in recent years left people locked out for weeks with their name still attached to whatever the account was posting.
Step 1: Open two-step verification
- Click your profile photo (top right) → Settings & Privacy.
- Select Sign in & security in the left menu.
- Click Two-step verification.
- Click Set up.
In the mobile app: tap your photo → Settings → Sign in & security → Two-step verification.
Step 2: Choose the authenticator app
LinkedIn offers two methods:
- Authenticator app — a six-digit code generated offline on your device. Choose this.
- Phone number (SMS) — a text message. Works, but the code travels through the mobile network, where an attacker who takes over your number at the carrier receives it without touching your phone. That is a SIM swap attack.
Select Authenticator app and enter your LinkedIn password when prompted. LinkedIn then displays a QR code with a text key beneath it for manual entry.
Any standard app works — Google Authenticator, Authy, Microsoft Authenticator, Aegis, 2FAS, or a password manager with TOTP. If you are choosing, see Authy vs Google Authenticator or our roundup of the best authenticator apps. The full comparison of methods is in SMS 2FA vs authenticator apps.
Step 3: Scan and confirm
- Open your authenticator app and add a new account.
- Scan LinkedIn’s QR code — or, if you are setting this up on the same device, copy the text key and use your app’s manual-entry option. Our guide to entering a setup key manually covers that path.
- Type the six digits into LinkedIn and confirm.
Do not screenshot the QR code. It contains your raw secret key, and anyone who obtains that image can generate valid codes for your account forever. If you want redundancy, scan the same code into a second app while it is still on screen — that is the moment to create a backup, and it never comes again.
Step 4: Save the recovery code
LinkedIn shows a recovery code immediately after setup. It is displayed once. Copy it somewhere permanent before you click away — printed, in an encrypted note, or in a password manager vault. Not your camera roll, not an unencrypted text file called “linkedin.txt”.
Given how difficult LinkedIn account recovery is without it, this code is doing more work than on most platforms. Our guide on where to store 2FA backup codes safely ranks the options, and if it does go wrong, recovering accounts after losing your 2FA phone covers the process.
Step 5: Lock down the email address
Two-step verification protects the front door. The email address on the account is the back door — and it is how most LinkedIn takeovers are finalised.
Under Sign in & security:
- Email addresses — remove any old or work addresses you no longer control. An address at a company you left is a live security hole.
- Make sure the primary address is one whose own account has strong 2FA. If your email falls, everything else follows — see our Google account 2FA guide.
- Phone numbers — remove numbers you no longer use.
Step 6: Audit sessions and app permissions
Three more items on the same page, each worth a minute:
- Where you’re signed in — end any session you do not recognise. Old laptops, phones you have sold, a browser at a previous job.
- Devices that remember your password — clear these if you have ever signed in on a shared machine.
- Permitted services — revoke third-party apps with access to your account. Automation, scraping and outreach tools are common here and often hold posting and messaging rights.
If you manage a Company Page, also check the admin list under Page settings and remove anyone who has left.
Frequently asked questions
Does LinkedIn support security keys or passkeys?
LinkedIn’s two-step verification is limited to authenticator apps and SMS — there is no FIDO2 security key option for consumer accounts. That makes the authenticator app the strongest available choice here. On services that do offer them, keys and passkeys are stronger because they cannot be phished.
Which authenticator app should I use with LinkedIn?
Any of them. LinkedIn uses standard TOTP with no proprietary extensions — see how TOTP codes work. Use the same app you already use for everything else rather than adding another.
Why is LinkedIn rejecting my code?
Usually clock drift — your phone’s time is out of sync with LinkedIn’s servers. Enable automatic network time in your date and time settings. Our guide to 2FA codes being rejected covers the rest.
Will 2FA log me out of my current devices?
Existing sessions generally stay active; you will be asked for a code on new sign-ins. If you suspect someone else is in the account, end all sessions manually after enabling it — turning on 2FA does not by itself evict an attacker holding a valid session.
Can I turn two-step verification off?
Yes, from the same page, with your password. It is rarely a good idea. If the friction bothers you, note that LinkedIn only prompts on new devices and browsers, not every login.
Someone is already in my account — what now?
Change your password immediately, check and correct the email addresses on the account, end all active sessions, then enable two-step verification. If the attacker has already changed the email, use LinkedIn’s account access help flow, which will ask for identity verification. Do this fast: the longer the account posts as you, the more damage to your professional contacts.
The bottom line
LinkedIn 2FA takes four minutes and the recovery code shown at the end is the part that matters most, because it appears exactly once and LinkedIn’s support queue is not where you want to be. App over SMS, recovery code saved offline, old email addresses removed, third-party tools revoked. Your professional reputation is the asset being protected here, and it is not one you can charge back.
Need a code right now to test your setup? Our free online 2FA code generator runs entirely in your browser.