How to set up two-factor authentication and passkeys on X

Two-factor authentication means that knowing your password isn't enough to get in. X asks for a second thing as well: a code from an app, a tap on a security key, or, for some accounts, a code sent by text. It's the single setting that stops most account takeovers, and it takes a few minutes.

All of these settings live in the same place. In the X app or on x.com, go to Settings and privacy > Security and account access > Security. You'll see Two-factor authentication there, and on the mobile apps a section called Additional password protection that holds Passkey and Password reset protect.

Which method to pick

A security key is a small USB, NFC or Bluetooth device that you touch to confirm a login. Because it checks the website's real address before answering, a fake login page gets nothing from it. An authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Authy, Ente Auth and others) generates a six-digit code every 30 seconds. It's free and works for everyone, but someone running a phishing page can ask you for the code and use it before it expires.

SMS codes are the weakest choice. X has limited text-message two-factor to X Premium subscribers since March 2023, and even when you have it, your codes follow your phone number in a SIM swap.

Our advice: everyone should set up an authenticator app at minimum. If your account matters to your income, your company or your safety, add a security key or passkey on top.

Set up an authenticator app

1. Install an authenticator app on your phone, or use the one built into your password manager.
2. Go to Settings and privacy > Security and account access > Security > Two-factor authentication.
3. Choose Authentication app and confirm your password.
4. X shows a QR code. Scan it with the app. If you're setting this up on the same phone, there's an option to link the app directly or copy a setup key.
5. Type the six-digit code the app shows to finish.

X then shows you a backup code. Don't skip this step; see the backup section below.

Set up a security key

1. Buy a FIDO2 security key from a known maker. Get two if you can, so one can live somewhere safe as a spare.
2. In Two-factor authentication, choose Security key and confirm your password.
3. Follow the prompts. On a computer, plug the key in when asked and touch it. On a phone, connect it by USB or NFC, or over Bluetooth if your key supports it.
4. Name the key so you can tell it apart from a spare later, and repeat the process for the second key.

X's help pages say a security key can be your only two-factor method. You'll still need the backup code if all your keys go missing at once. On web, X asks for a current version of a supported browser such as Chrome, Edge, Firefox, Opera or Safari.

Add a passkey

A passkey is a login credential stored on your phone, in your password manager or in your device's keychain, and unlocked with your face, fingerprint or screen PIN. X stores only the public half. The private half never leaves your device, which is why there's nothing for a phishing page to steal.

On X, passkeys are available in the iOS and Android apps. To add one:

1. Open Settings and privacy > Security and account access > Security.
2. Under Additional password protection, tap Passkey.
3. Confirm your password, tap Add a passkey and follow your phone's prompts.

On X a passkey is a sign-in option rather than a replacement for the rest. Your password still exists and can still be used to sign in, so keep two-factor authentication turned on as well. A passkey plus an authenticator app or security key is a strong combination.

Turn on password reset protect

While you're on the same screen, switch on Password reset protect. With it on, anyone who asks X for a password reset has to confirm your account's email address or phone number first. It makes reset abuse slower and noisier, and it costs you nothing.

Keep a backup code that actually works

The backup code is a one-time code that gets you in when your phone or key isn't available. You can view or generate a new one under Two-factor authentication > Additional methods > Backup codes.

Store it somewhere you'll be able to reach without the device it protects. A password manager entry works, as does a printed copy in a drawer. Don't keep it only as a screenshot on the same phone that runs your authenticator app.

If you log in to X from an older app or device that asks for your password and can't handle two-factor prompts, generate a temporary password under Two-factor authentication > Additional methods. X says these expire after an hour. The official X apps and mobile.x.com don't need one.

Mistakes we see often

• Leaving SMS as the only method after a Premium subscription lapses. Check that you still have a working second factor when your plan changes.
• Setting up the authenticator on a phone you're about to trade in. Most apps can export or sync codes; move them before the old phone is wiped.
• Using a passkey and turning everything else off. The password route still exists, so the second factor still matters.
• Securing X and forgetting the email inbox. Whoever controls your email can reset your X password, so the email account needs its own two-factor.

After you're done, run the security check to see what else is open.

Sources: X Help Center, How to use two-factor authentication and How to use passkeys.

Questions

TweetAttacks is independent and not affiliated with X Corp. Settings names can change when X updates its apps; if a menu has moved, search its name in X's settings.