Two-factor authentication and login activity on Instagram

A password can easily leak on a fake login page or from another website. With two-factor authentication, that alone is not enough: on an unknown phone or browser, Instagram asks for a second confirmation. In the app, the feature is called “Two-factor authentication” and is found in Accounts Center, in the same place as the list of logged-in devices.

Where is the setting?

Password and login settings are in Accounts Center, which is shared with Facebook and Messenger (in a browser: accountscenter.instagram.com). In April 2026, Meta announced that Accounts Center would gradually become the Meta Account.

1. In the app, tap the profile picture in the bottom right, then the menu icon in the top right. In a browser, “More” in the bottom left, then “Settings” leads here.
2. Open “Accounts Center” at the top of the settings list.
3. In Accounts Center, choose the “Password and security” section.
4. This is where “Two-factor authentication” is, with the login locations and the security check below it. If several accounts are linked, first select the one the setting applies to.

The three methods

At least one method is required; if several are set up, one can be chosen when logging in. A physical security key is currently not among the methods available for Instagram's two-factor authentication.

• Authentication app (recommended): for example Google Authenticator, Microsoft Authenticator, Duo Mobile or a password manager's code generator. It shows a new code every half minute, even without signal, and can be added to several devices. It can only be turned on in the Instagram app for Android or iPhone.
• Text message (SMS): the login code arrives at the phone number provided. Simple, but it may fail abroad or after a number change.
• WhatsApp: the code arrives in the WhatsApp account linked to the phone number. It can only be turned on if the text message method is already on.

Turning it on with an authentication app

1. First install the authentication app on the phone.
2. On the “Two-factor authentication” page, select the account, then the authentication app.
3. Instagram shows a QR code; scan it with the authenticator. If both apps are on the same phone, copy the key shown instead of the QR code.
4. Enter the code shown in the authenticator back into Instagram. For text messages, enter the phone number (a number already added to the account also works) and type in the code received.

Backup codes

Backup codes are single-use codes for cases when the login code does not arrive, the phone is lost, or the authentication app's data is deleted.

1. On the “Two-factor authentication” page, select the account, then “Additional methods”.
2. The “Backup codes” option shows the codes; “Get new codes” provides a new set, and the old codes stop working.
3. The codes can only be viewed while logged in, so they must be saved in advance: in a password manager or on paper, kept separately from the phone. Anyone who knows a backup code in addition to the password can log in, so these must never be given to anyone.

Where is the account logged in?

In the “Password and security” section, the list of logins shows which phones and browsers the account is logged in on. The location is estimated from the IP address, so on mobile data it often shows a different city.

1. Open the list and review the devices, locations and time of last activity.
2. Tap an unknown device and choose to log it out; several devices can be selected at once.
3. If there was an unknown device, change the password as well, because that is how the person got in. When changing the password, Instagram offers to log out of the other devices too.

Trusted devices and login requests

• Trusted device: when logging in with two-factor authentication, your own phone or computer can be marked as trusted, so no code is needed there next time. Never tick this on a shared or public computer. A sold or lost device should be removed from the trusted devices.
• Approval on another device: instead of a code, the new login may need to be confirmed on a phone that is already logged in. Reject any request that the owner did not start. Instagram also sends an email about logins from a new device, from mail.instagram.com.
• Unrequested code: if a login code arrives even though nobody tried to log in, someone knows the password, so it needs to be changed. Never pass the code on to anyone: Common scams on Instagram.