A Short Timeline of X's 2FA Policy
In early 2023, X (still transitioning from the Twitter name at the time) announced that SMS-based two-factor authentication would become a Premium subscriber perk, and free accounts without a paid subscription had it switched off automatically after a short grace window. The announcement caused a wave of confusion, and a lot of users read the headline as "2FA now costs money" and disabled the feature entirely rather than switching to a different method. That reaction was, and still is, backwards. The two methods that remain completely free on every account tier, authenticator apps and hardware security keys, have always been considered stronger than SMS by the security community. If X's policy change pushed you off SMS, it did you an accidental favor, provided you actually moved to one of the free alternatives instead of turning 2FA off altogether.
Setting Up Free Authenticator App 2FA
- Open X and go to Settings and privacy, found under More on desktop or through your profile icon in the mobile app.
- Select Security and account access, then Security.
- Tap Two-factor authentication.
- Check Authentication app.
- Confirm your password, and X displays a QR code.
- Scan it with Google Authenticator, Authy, Microsoft Authenticator, or any TOTP-compatible app.
- Enter the six-digit code the app generates to confirm setup.
From that point forward, every login on a new device asks for your password plus the current code. The QR code you just scanned encodes a standard otpauth link containing a Base32 secret, and you can inspect any 2FA QR code, including this one, with our QR decoder, or generate codes from a raw secret with our free online 2FA generator.
Before you leave the setup screen, X shows a single-use backup code. Save it in a password manager immediately, since it is your way back in if your phone is ever lost or your authenticator app is wiped. You can generate a fresh one at any time from the same Two-factor authentication page. Our backup codes guide covers safe storage in more depth.
Why the Free Options Beat the Paid One Anyway
X supports hardware security keys under the FIDO2 and WebAuthn standards as a fully free method, and it will even let you make a key your only 2FA option, removing weaker fallbacks like SMS or the authenticator app entirely. A hardware key cryptographically checks that you are actually on x.com before it responds to a login request, which means it cannot be fooled by a convincing fake login page the way a typed code can. To enable it, open Two-factor authentication, check Security key, insert or tap your key when prompted, and name it for your own reference. Anyone whose account carries real reach, journalists, brand managers, anyone whose posts move markets or make news, should be on a security key rather than an authenticator app alone. Our hardware key guide and FIDO2 explainer cover the mechanics, and our passkey tester checks whether your device supports it before you buy anything.
Who Attackers Actually Want on X
Account takeovers on X follow a predictable target list. Verified accounts and blue-check holders are valuable because the checkmark itself functions as a trust signal, so a hijacked verified account can spread convincing scam links or fake announcements that ordinary accounts cannot. Developer and API-connected accounts are a second, less obvious target, since an account with an active developer app or connected third-party tooling can be used to pull data, automate spam, or pivot into other connected services entirely outside the X interface. A single high-profile takeover has previously moved cryptocurrency prices and spread fake breaking news within minutes of the post going up, before anyone at the platform could intervene. Your account does not need to be famous to be dangerous in the wrong hands, it just needs to be trusted by whoever follows it, which describes almost every account with more than a handful of followers.
What Happened to Legacy SMS Users
Accounts that had SMS 2FA enabled before the policy change did not get a replacement automatically applied, the protection was simply removed, sometimes leaving the account with no active 2FA at all until the owner noticed and set up something new. Check your own status now:
- Go to Security and account access, then Security, then Two-factor authentication.
- If nothing is checked, your account is currently running on password alone. Fix that today using the authenticator app steps above.
- While there, also review Additional password protection, a separate setting that requires extra verification specifically during password reset attempts.
This gap is the single most common reason long-time X users discover, usually after a scare, that their account has been unprotected for months without their knowledge.
Recovery, and Its Real Limits
If you lose access to both your authenticator app and your backup code, look for the "Lost access" links during login, which lead to X's account recovery form. You will need access to the email address or phone number on file to proceed, and the review process can take days with no guaranteed outcome, particularly if the account details on file are themselves outdated. This is why the backup code X generates during setup is not an optional extra step, it is the fastest recovery path that exists and the only one entirely under your own control.
Round Out Your X Account Security
- Check connected apps under Security and account access, then Apps and sessions. Old third-party tools with write access are a quiet, often forgotten risk. Revoke anything you no longer use.
- Review active sessions and sign out any device you do not recognize.
- Use a unique password. If your X password appears anywhere else, rotate it with our password generator, since reused passwords are the input for credential stuffing attacks that do not even need to touch your 2FA.
- Keep your registered email current, since every recovery flow on X ultimately routes through it.
Frequently Asked Questions
Is any real 2FA on X actually free, or is that just marketing?
It is genuinely free. Only the SMS text message method requires a Premium subscription. Authenticator apps and hardware security keys are available to every account tier at no cost, and both outperform SMS on security.
Why did X restrict SMS 2FA in the first place?
X pointed to the direct cost of SMS delivery and to SMS pumping fraud, where automated traffic generates fake verification messages at the platform's expense. Whatever the underlying motive, the security community's longstanding position was that authenticator apps were always the better default. Our post on SMS 2FA weaknesses explains why in more depth.
Can I run 2FA on more than one X account from the same phone?
Yes. Each account has its own independent 2FA setting and its own separate entry in your authenticator app, so managing several accounts just means repeating the setup steps once per account.
I lost both my authenticator app and my backup code. Is my account gone?
Not necessarily, but recovery is slower and less certain. Use the "Lost access" option during login, which requires proving ownership through the email or phone number on file, and expect the review to take days rather than minutes.
Does turning on 2FA stop someone from impersonating me with a lookalike account?
No, 2FA only controls logins to your actual account. Impersonation through a separate lookalike profile is a moderation and reporting issue, handled entirely differently. What 2FA guarantees is that posts coming from your real handle are actually from you.
