--- title: "Secure X Account: 2FA, Passkeys and Reset Protection" description: "Secure your X account in one sitting: a unique password, the right two factor option, password reset protection, app and session checks, and phishing habits." url: https://kairopost.com/blog/secure-x-account --- # How to secure your X account: the settings that matter By Sami Kerr Published 7 November 2026 12 min read (A door edge with five different latches stacked one above the other, labelled Password, Second step, Reset protect, Apps and Sessions, the top latch glowing amber, beside the title How to secure your X account and the label Rules and account safety.) ## The short answer To secure your X account, use a password you reuse nowhere, turn on two factor authentication with an authentication app or a security key, switch on Password reset protect, remove apps and sessions you do not recognise, and never type your password into anything except x.com. ## Key takeaways - X offers three two factor methods: authentication app, security key and, only for X Premium subscribers, text message. - Switch on Password reset protect so a reset needs your email address or phone number, not just your username. - Open Apps and sessions, then revoke connected apps and log out sessions you do not recognise. - X says it never asks for your password by email, Direct Message or reply, and only sends email from x.com. - Give teammates a Delegate role instead of your password. Only the owner manages password and login verification. ### Contents12 sections To secure your X account, lock five things in order: the password, the second sign in step, the password reset form, the apps and sessions already signed in, and your own habits around links and messages. X has a setting for each one. This guide shows where they are and which choice to make. Then go through the apps you have authorised: how to review and remove connected apps. It is written for people who run an account that matters: a brand, a founder profile or a client account. If other people post for you, the section on Delegate saves you from the most common mistake. Keep a copy of your data too: how to download your X archive. ## Where an X account can be attacked An X account has five doors, and a strong lock on one does not help while another stands open. Lock them in this order. Lock 1 The password A short or reused password is the easiest way in. X's own tips ask for a strong password you use nowhere else. Lock 2 The second step Two factor authentication means a stolen password is not enough on its own. Lock 3 The reset form Anyone can type your public username into account recovery. Password reset protect makes that request harder. Lock 4 Apps and sessions Every connected app and every logged in device has already been let in. Prune the list. Lock 5 You Phishing asks you to open the door yourself. X says it never asks for your password by email, Direct Message or reply. The order matters. A strong password with no second step still falls to one convincing fake page, and a second step does not help if an old app still has the right to post for you. Locked out by a forgotten password? See how to recover a forgotten X password. Everything below sits in one place. Open Settings and privacy, then Security and account access. Privacy settings sit next door; see the privacy settings every brand should check. (Three columns of a settings menu. Settings and privacy leads to Security and account access. That leads to Security, Apps and sessions and X Delegate. Under Security: Two-factor authentication, and Additional password protection with Password reset protect and Passkey. Under Apps and sessions: Connected apps and Sessions.) Where each setting in this guide lives. Menu names are the ones X's help pages use in October 2026. Menus move. If yours looks different, search your settings for the name in bold below. The names are what matter. ## Use a password nobody can guess or reuse X's advice is plain: a strong password that you do not reuse on other sites. Its security tips spell out what strong means. - **Length and mix.** At least 10 characters, mixing upper case, lower case, numbers and symbols. - **One password per site.** A different password for every website you visit. - **Nothing personal.** No personal information, common dictionary words or runs such as abcd1234 or qwerty. A password manager is the practical way to do this, because nobody remembers a different long password for every site. That part is our advice, not X's. 10 characters, the minimum in X's password tip X Help Center, Tips for keeping your X account secure 60 minutes a reset code stays valid X Help Center, How to reset a lost or forgotten password A password only X knows Generated by a password manager, longer than 10 characters, used on X and nowhere else. A password with a story A pet's name, a year and a symbol on the end, reused on three other sites. Reset codes matter here too. X sends the code to the email address or phone number on the account, and it stays valid for 60 minutes. Whoever controls that inbox can finish a reset. Your email is a master key Give the email address on your X account its own strong password and its own second step. A locked X account with an open inbox is not locked. ## Which two factor option should you pick on X Pick an authentication app or a security key. X lists three two factor methods: text message, authentication app and security key. Text message is only for X Premium subscribers: X's help page says it stopped supporting it for everyone else from 20 March 2023. (Four counters under two signs. Under the sign Phishing resistant: Security key, a physical key you touch, and Passkey, your device unlocks it. Under the sign You type a code: Authentication app, codes from an app you choose, and Text message, X Premium only.) Security keys and passkeys are FIDO based. Codes from an app or a text message can still be typed into a fake page. ### Why we put keys and passkeys first CISA's guidance says the only widely available phishing resistant authentication is FIDO/WebAuthn. Security keys and passkeys are both built on FIDO standards. A code from an authentication app is not, because you can type it into a page that looks like X. CISA also says any MFA is better than no MFA. So an authentication app is a good choice if you have no key. X does not rank its methods. This ranking is our reading of CISA's definition. Definition Passkey A sign in credential based on FIDO standards. It lives on your phone, computer or hardware key, and you unlock it the way you unlock the device. On X it sits under Additional password protection and is encouraged, not required. ### Turn on two factor, step by step 1. Open the settings: Go to Settings and privacy, then Security and account access, then Security. 2. Choose Two-factor authentication: Pick Authentication app or Security key. Text message appears only if you subscribe to X Premium. 3. Pair your authentication app: Scan the QR code with any time based one time password app. X names Google Authenticator, Authy, Duo Mobile and 1Password. Enter the code it shows and tap Verify. 4. Save your backup code: X says to write it down, print it or take a screenshot. Keep a copy somewhere other than the phone that holds your app. 5. Add a passkey (optional) In the X app on iOS or Android, go to Security, open Passkey under Additional password protection, enter your password and choose Add a passkey. Why the backup code matters If you lose your phone and you are logged out with no active backup code, X says you must contact its support team. Save the code today, not after the loss. ### I added a security key a long time ago X told people with security keys to enrol them again by 10 November 2025, because keys had been tied to an older X domain. The Hacker News reported that after that date an account with a key that was not enrolled again stayed locked until the owner enrolled again, chose another method or chose no two factor. Authentication apps were not affected. If you see an old key in your list, open Security key, then Manage security keys, and check it still works. ### Apps that still ask for your X password After you turn on two factor, other devices or apps that ask for your X password need a temporary password. X says it sends one by text message when it detects you need it, or you can generate your own on x.com. Better still, connect tools through X's approval screen, so no password is typed at all. ## Turn on Password reset protect Password reset protect makes X ask for the email address or phone number on your account before it sends a reset link or code. X's help pages call it password reset protection. In the app the switch reads Password reset protect. It matters because of how recovery works. Without it, a username alone is enough for someone to request a reset link, and usernames are public. A username is enough, unless the gate is onTop lane: the form sends a real email to the owner for any username. Bottom lane: it asks for the full email or phone first, so nothing is sent. That is the weak spot attackers used at the start of September 2026. TechCrunch reported on 1 September that attackers were triggering password reset requests in bulk, using public usernames, after X Money launched. X product engineer Mridul Singhai said X was investigating and had found no evidence of breaches. 1. Open the Security page: Settings and privacy, then Security and account access, then Security. 2. Find Additional password protection: Switch on Password reset protect. 3. Confirm with your password: Enter your current account password and choose OK. A reset email you did not ask for is not a break in It means someone typed your username into the form. Do not click the link. Open the X app yourself, turn on Password reset protect, and check Two-factor authentication is on. ## How to review connected apps and sessions Open Apps and sessions and remove anything you do not recognise. Connected apps lists every tool you have approved, with the permissions each one holds. Sessions lists every active login with its location and time. Depending on what you granted, X says a connected app may read your posts, see who you follow, update [your profile](https://kairopost.com/blog/x-profile-optimization), post for you, access your Direct Messages or see your email address. That is a lot of reach to leave with a tool you stopped using. Walk the guest listKnown tools get a tick. An unknown app is revoked and an unknown session is logged out. Example names only. 1. Open Connected apps: Settings and privacy, then Security and account access, then Apps and sessions, then Connected apps. 2. Revoke what you do not use: Choose Revoke access next to any app you do not recognise or no longer use. 3. Open Sessions: Look at each login's location and time. Choose Log out next to one session, or Log out all other sessions at the top of the list. What logging out does It stops further actions from that session, such as posting, liking and replying. X adds that it may not delete data, such as Direct Messages, already cached on that device. How a tool asks for access is a test in itself. A trustworthy tool sends you to x.com to approve it and never asks for your password. That is how Kairo Post works: account owners approve it on x.com with OAuth 2.0 and PKCE, and we never see X passwords. Tools that post for you also fall under [X's rules](https://kairopost.com/blog/x-rules-for-brands-and-creators-explained-simply). Our guide to [X automation rules](https://kairopost.com/blog/x-automation-rules) explains what they allow. ## Share access without sharing your password Give people a Delegate role, never your password. X Delegate lets you invite someone as an admin or a contributor. It sits under Security and account access. | Sharing the password | Using Delegate | | --- | --- | | Anyone who knows it can change it and lock you out | Only the owner manages the password, phone number and login verification settings | | Taking one person's access away means changing the password for everyone | Owners and admins can manage who is on the account. Contributors cannot | | Everyone gets the same power, or none | Each person is invited as an admin or a contributor | > **Know who has access.** The account most at risk is rarely the one with the weakest password. It is the one where nobody can say who still has access. A shared password makes that impossible to answer. A role you can see and manage does not. This is the short version. The full set of roles, approvals and onboarding steps is in our guide to [managing X for clients](https://kairopost.com/blog/managing-x-for-clients). ## How to spot phishing aimed at your X account The rule is short: X says it never asks for your password by email, Direct Message or reply, and it only sends email from x.com. Anything else is a trap. Open the X app yourself instead of clicking. 1 email domain X sends from: x.com X Help Center, How to recognize authentic X emails 0 times X asks for your password by email, Direct Message or reply X Help Center, Tips for keeping your X account secure Read what comes after the at signOnly the part after the at sign counts. A close look alike address is still not X. The look alike here is made up. Three lures are worth knowing, because they are the ones X and the press describe. Email The fake login alert It says there was a login from a new device and asks you to click to change your password or review app access. The links lead to a fake site or to a malicious app that asks for access. Direct Message The offer X warns about third parties promising followers, money or verification in return for your username and password. Email or text The urgent reset Reset messages you never requested arrived in floods in September 2026. Skip the link and go to the app. Account Review Desk@review_desk_example Example You are eligible for a verification badge. Confirm your login at the link below within 24 hours to keep your place. Example of a fake Direct Message. Made up for this guide. The [giveaways](https://kairopost.com/blog/x-giveaway-rules): a link, a deadline, and a request to log in. Nothing in it names your account. 1. Early June 2026: Email gets a sender check: X says it added a Mark Certificate to emails it sends. Many email apps show a blue checkmark next to the sender. 2. July 2026: Fake alerts look real: The Next Web reported phishing emails that copy X's login notifications almost exactly, with correct logo and grammar. Real alerts name your handle. 3. 1 September 2026: Reset email flood: Users received reset emails they never requested after the launch of X Money. An X engineer said there was no evidence of breaches. Before you click anything that claims to be from X - The sender address ends in x.com. - It names your account, not just "user". - It has no attachment and does not ask for your password or a code. - You can fix the problem by opening the X app, without using the link. ## What to do if someone already has access If you can still log in, work through these in order. They come from X's page for compromised accounts. 1. Change your password: Use a new strong password you have not used before. If you are logged out, use Forgot password on the login page. 2. Revoke apps you do not recognise: Open Apps and sessions, then Connected apps. X lists this as its own step, so do it even after the password change. 3. Log out other sessions: In Sessions, choose Log out all other sessions. 4. Update trusted apps: If a trusted app uses your X password, update it there. Otherwise failed login attempts can lock you out. 5. Clean up: Delete posts you did not write and scan your computer for malware. 6. Ask X if you still cannot get in: Send a support request from the email address on the account, with your username and the date you last had access. ## Which steps matter most for your kind of account Every account needs the same five locks. What changes is which one is most likely to slip. This is our advice, based on how each kind of account is run. One person A solo creator Start with the password and a security key or authentication app. Then switch on Password reset protect. You have the fewest moving parts, so these three cover most of the risk. Several people A brand with a team The weak spot is access. Move everyone to Delegate roles, then review Connected apps whenever a scheduling or reporting tool is added or dropped. Many accounts An agency with clients Each client owns their login. Ask the owner to set up two factor and keep the backup code, then invite your team as delegates. Never keep a client's password in a shared sheet. When a person leaves a team, the check is short: remove their Delegate role, and review Connected apps for anything they set up. If they only ever had a role, nothing else needs to change. That is the payoff of never sharing the password. ## A security check you can repeat You do not need a quarterly project. Run this list when you set up an account, when a person joins or leaves, and whenever a strange email arrives. The X account security check - The password is unique and lives in a password manager. - Two factor is on with an authentication app or a security key, and the backup code is saved. - Password reset protect is switched on. - The email address on the account has its own strong password and second step. - Connected apps and Sessions hold only things you use today. - Nobody holds the password. Teammates have Delegate roles. If you connect tools to your account, ask how each one asks for access and what it stores. Those questions are fair for every tool you try, ours included. In the product ## How Kairo Post does this Everything above works by hand. Kairo Post does the same work for you, with your approval before anything goes out. - [Feature Accounts & teams Many accounts, clear roles, client workspaces.](https://kairopost.com/features/teams) ## Questions people ask ### Is text message two factor still available on X? Only with X Premium. X's help page says that since 20 March 2023 it no longer supports text message two factor for people without Premium, and anyone still using it is prompted to turn it off. Without Premium, use an authentication app or a security key instead. ### Which two factor option is the safest on X? X lists text message, authentication app and security key and does not rank them. CISA says the only widely available phishing resistant authentication is FIDO/WebAuthn, which security keys and passkeys use. Our reading: a security key is the strongest choice, an authentication app is a solid second, and any method beats none. ### What happens if I lose the phone that holds my authentication app? Use the backup code X asked you to save. It lets you log in and update your settings. If you are logged out and have no active backup code, X says you must contact its support team, which is why the backup code is worth saving on the day you turn two factor on. ### Why am I getting password reset emails I did not ask for? Someone can type your public username into X's recovery form, and X then sends you a real reset message. In September 2026 X said attackers were doing this at scale and that it had found no evidence of breaches. Do not click the links. Turn on Password reset protect and two factor instead. ### What is a temporary password on X? After you turn on two factor, other devices or apps that ask for your X password need a temporary password instead. X says it sends one by text message when it detects you need it, or you can generate your own on x.com. A better route is to connect tools through X's approval screen, so no password is typed. ### Do I need to give my social media manager my X password? No. Invite them through Delegate as an admin or a contributor and keep the password, phone number and login verification settings yourself, because only the owner manages those. If a tool needs access, approve it on x.com rather than typing your password anywhere else. ## Sources Every rule, limit and figure in this post was checked against these on the date shown. 1. [Safety on X: enrol security keys again by 10 November](https://x.com/Safety/status/1981764501947953225) x.com: · checked: 1 October 2026 2. [How to use two-factor authentication, X Help Center](https://help.x.com/en/managing-your-account/two-factor-authentication) help.x.com: · checked: 1 October 2026 3. [Help with two-factor authentication, X Help Center](https://help.x.com/en/managing-your-account/issues-with-login-authentication) help.x.com: · checked: 1 October 2026 4. [How to use passkey, X Help Center](https://help.x.com/en/managing-your-account/how-to-use-passkey) help.x.com: · checked: 1 October 2026 5. [Tips for keeping your X account secure, X Help Center](https://help.x.com/en/safety-and-security/account-security-tips) help.x.com: · checked: 1 October 2026 6. [About third-party apps and log in sessions, X Help Center](https://help.x.com/en/managing-your-account/connect-or-revoke-access-to-third-party-apps) help.x.com: · checked: 1 October 2026 7. [Help with my compromised account, X Help Center](https://help.x.com/en/safety-and-security/x-account-compromised) help.x.com: · checked: 1 October 2026 8. [How to recognize authentic X emails, X Help Center](https://help.x.com/en/safety-and-security/fake-x-emails) help.x.com: · checked: 1 October 2026 9. [How to use the Delegate feature, X Help Center](https://help.x.com/en/managing-your-account/how-to-use-the-delegate-feature) help.x.com: · checked: 1 October 2026 10. [How to reset a lost or forgotten password, X Help Center](https://help.x.com/en/managing-your-account/forgotten-or-lost-password-reset) help.x.com: · checked: 1 October 2026 11. [More than a password, CISA](https://www.cisa.gov/MFA) cisa.gov: · checked: 1 October 2026 12. [Passkeys, FIDO Alliance](https://fidoalliance.org/passkeys/) fidoalliance.org: · checked: 1 October 2026 13. [X says attackers are targeting accounts after the launch of X Money, TechCrunch](https://techcrunch.com/2026/09/01/x-says-attackers-are-targeting-accounts-after-the-launch-of-x-money/) techcrunch.com: · checked: 1 October 2026 14. [How to stop getting unwanted password reset emails from X, iDownloadBlog](https://www.idownloadblog.com/2026/09/02/password-reset-protect-x/) idownloadblog.com: · checked: 1 October 2026 15. [New X phishing scam copies real login alerts down to the pixel, The Next Web](https://thenextweb.com/news/x-phishing-scam-fake-login-notification-crypto) thenextweb.com: · checked: 1 October 2026 16. [X Warns Users With Security Keys to Re-Enroll Before November 10, The Hacker News](https://thehackernews.com/2025/10/x-warns-users-with-security-keys-to-re.html) thehackernews.com: · checked: 1 October 2026 Written by ## Sami Kerr, founder of Kairo Post Keep reading ## More in Rules and account safety [All posts on this topic](https://kairopost.com/blog#rules) - (X rules for brands and creators. A signpost with three boards labelled Safety, Privacy and Authenticity. Rules and account safety.) Rules and account safety · Guide: ### [X rules for brands and creators, explained simply](https://kairopost.com/blog/x-rules-for-brands-and-creators-explained-simply) A plain map of the X rules that matter to brands and creators: spam, impersonation, copyright, paid partnerships, media and what to do if X acts. 12 October 2026: 20 min read ## Post at the right moment. Starting today. Connect an account, describe your voice and let Kairo Post do the legwork. [Get started](https://app.kairopost.com/signup) [See pricing](https://kairopost.com/pricing)