How to Secure Your Instagram Account: 8 Steps

Most Instagram accounts aren't lost to sophisticated hacking. They're lost to simple mistakes: a weak password, the same password reused on other sites, or trusting a fake "Instagram support" message. These eight steps protect you from almost all of those attacks.

1. Use a strong password only for Instagram

Your password should be at least 14–16 characters long and not used anywhere else. Keep your name, birth year, phone number and favourite team out of it — passwords like Aysel1995! are among the first combinations cracking tools try.

The easiest way: create a random password with the password generator and store it in a password manager. If you'd rather remember it, use a passphrase.

2. Turn on two-factor authentication (2FA)

This is the single most important step. With 2FA on, even someone who knows your password can't log in without the code from your phone.

In Instagram: Profile → ☰ menu → Accounts Center → Password and security → Two-factor authentication. Menu names can vary slightly between app versions.

If you can, choose an authenticator app (Google Authenticator, Microsoft Authenticator, 2FAS, etc.) instead of SMS. SMS codes can be stolen with a fraudulent SIM swap; codes in an app stay on your phone. More: What is two-factor authentication?

3. Save your backup codes

When you turn on 2FA, Instagram gives you backup codes. If you lose your phone, they're the only way back in. Keep them in a password manager or on paper somewhere safe — not as a screenshot in your photo gallery.

4. Don't trust "Instagram support" messages

The most common scam: a DM or email says "Your account will be disabled for copyright infringement" or "Fill in this form to get verified", with a link that asks for your password.

Remember:

• Instagram never asks for your password or a code by DM.
• You can check real Instagram emails inside the app: Accounts Center → Password and security → Recent emails. If it isn't there, it's fake.
• If the link isn't on instagram.com (e.g. lnstagram-help.com, meta-support-center.net), don't type anything.

5. Never share a code — not even with a "friend"

A classic: a message from a friend's (already hacked) account says "I sent a code to your number by mistake, can you forward it?". That's the recovery code for your account. Once you share it, the account is theirs. Never send any code to anyone, for any reason.

6. Check where you're logged in

Under Accounts Center → Password and security → Where you're logged in you'll see every device signed into your account. If you see an unknown device or city, log it out and change your password immediately.

7. Remove third-party apps

Don't give your Instagram password to "see who viewed your profile" or "get more followers" apps. Review apps you've authorised under Accounts Center → Apps and websites and remove the ones you don't need.

8. Protect your email too

Your email is used to reset your Instagram password. If your email is hacked, Instagram goes with it. Give your email its own strong password and 2FA as well.

Already hacked? Do this

1. Check your email right away — when the email address is changed, Instagram sends a message from [email protected] with a link to revert the change.
2. On the login screen choose "Forgot password?" or "Need more help?" and follow Instagram's official recovery flow (it may ask for a video selfie to confirm it's you).
3. Once you're back in, change the password, log out of all sessions and turn on 2FA.
4. Warn your friends not to trust messages sent from your account while it was hacked.

Don't pay people who "promise" to recover your account — the vast majority are scammers.

Quick checklist

• A unique password of at least 14 characters
• Two-factor authentication on (with an app)
• Backup codes stored safely
• No unknown devices logged in
• Unneeded apps removed
• Email protected with 2FA too

Want to know how strong your password really is? Check it here — the check runs in your browser and the password is never sent anywhere.