Twitter Two-Factor Authentication on X: Setup, Backup Codes and Fixes

That text message rule is the one most guides miss. X stopped supporting text message two-factor authentication for accounts without Premium on 20 March 2023, which is why older advice to just add your phone number no longer works. Here's the full setup, in X's own steps.

The three 2FA methods X offers

Method	How it works	Who can use it
Authentication app	A time-based code from an app such as Google Authenticator, Authy, Duo Mobile or 1Password	Everyone
Security key	A physical key plugged in by USB or connected by Bluetooth or NFC	Everyone
Text message	A six-digit code sent to your phone at login	X Premium subscribers only, and X says availability varies by country and carrier

X also notes that a security key can be your only method, with no other method switched on.

How to set up 2FA with an authentication app

1. Open X and go to Settings and privacy, then Security and account access, then Security, then Two-factor authentication. On desktop, start from More in the side menu.
2. Tick Authentication app, read the overview and tap Start.
3. Enter your password if asked. If you haven't confirmed an email address yet, X will ask you to now and send a code to it.
4. Tap Link app now and scan the QR code with your authentication app.
5. Enter the code your app shows and tap Verify, then Got it.

New to authenticator apps? My guide to setting up and backing up Google Authenticator walks through the app side, including moving codes to a new phone.

How to add a security key

1. In the same Two-factor authentication menu, choose Security key and enter your password.
2. Read the overview and tap Start.
3. Insert the key by USB, or connect it by Bluetooth or NFC, and touch the button on the key.
4. Follow the prompts. Your key then appears under Manage security keys, where you can rename it, delete it or add more.

On a computer, X says you need the latest version of a supported browser such as Chrome, Edge, Firefox, Opera or Safari to add or log in with a key.

Your backup code

When you finish setup, X shows a backup code on the confirmation screen. X's advice is to store a screenshot of it, because it's how you get back in if you lose your phone or change your number. Put it in a password manager rather than your camera roll, where it's easy to delete by accident.

Logging in after 2FA is on

Each time you log in, X asks for your password and the 2FA method you used last time. If you don't have that method to hand, tap Choose a different two-factor authentication method and pick another one you've set up.

Temporary passwords for other apps

Once 2FA is on, some devices and apps that ask for your X password won't accept your normal one. X's fix is a temporary password:

1. Go to Settings and privacy, then Security and account access, then Security.
2. Under Additional methods, choose Temporary password.

X says temporary passwords expire after one hour, and you don't need one for the X apps on iPhone and Android or for mobile.x.com.

If you still have text message 2FA on a free account

X's note on the change says that anyone without Premium who still had text message 2FA switched on would be prompted to turn it off before they could keep using the account. If you've seen that prompt, don't just dismiss it and carry on with only a password. Go straight back into the Two-factor authentication menu and set up an authentication app or a security key so the account is protected again.

How to turn 2FA off

Go back to Two-factor authentication and switch off the method: tap the slider on iPhone, untick the box on Android or desktop, then confirm. Only do this if you're replacing it with another method; an account with only a password is far easier to take over.

Add a passkey too

X also supports passkeys on iPhone and Android. A passkey lets you sign in with your device's own security, such as your fingerprint, Face ID or device PIN, instead of typing a password. X explains that your device creates a unique key pair: the public key is stored by X and the private key never leaves your device. Set it up under Settings and privacy, Security and account access, Security, then Passkey under Additional password protection.

Already locked out? Start with my steps for getting a hacked X account back.

Which method should you choose?

Your situation	Best choice
Free X account	Authentication app, plus a saved backup code
Business or brand account several people use	Security keys for each person, or X Pro's Teams feature so nobody shares the password
Premium account that travels a lot	Authentication app as your main method, text message as a backup only

If you want the bigger picture on why this matters, I've written a plain-English guide to what two-factor authentication is and how it protects you.

My verdict

Turn on two-factor authentication on X today, and use an authentication app rather than text messages even if you pay for Premium; codes tied to a phone number are the weaker option. Save the backup code somewhere you'll find it in two years, and if your business account matters to your income, add a security key as well.

Texts not turning up? I've explained the usual causes in my guide to X text messages and verification codes.

Frequently asked questions

Can I use text message 2FA on X for free?

No. X stopped supporting text message two-factor authentication for non-Premium accounts from 20 March 2023. Free accounts can use an authentication app or a security key.

Where is two-factor authentication in X settings?

Go to Settings and privacy, then Security and account access, then Security, then Two-factor authentication. On desktop, open More in the side menu first.

Where do I find my X backup code?

X shows a backup code on the confirmation screen when you finish setting up two-factor authentication and recommends saving a screenshot of it.

Which authentication apps work with X?

X says you can use any time-based one-time password app, such as Google Authenticator, Authy, Duo Mobile or 1Password.