How to Set Up Two-Factor Authentication on Facebook

Facebook accounts are among the most commonly targeted by attackers. A compromised Facebook account can be used to send phishing messages to your contacts, post spam, access connected apps, and in some cases lead to financial fraud through Facebook Marketplace or linked payment methods. Two-factor authentication (2FA) prevents unauthorised sign-ins even when your password has been exposed in a data breach or guessed by an attacker.

Why Facebook 2FA Matters

Facebook is the world's largest social network with over 3 billion monthly active users, making it a prime target for account takeovers. Attackers use credential stuffing — automated attempts with leaked passwords from other breaches — to break into Facebook accounts. Once inside, they can impersonate you, scam your friends via Messenger, post spam on your timeline, access your Marketplace listings, and even attempt to reset passwords on connected services.

Social engineering attacks are also common. A friend's compromised account may send you a message asking for your phone number or a "verification code" that is actually your Facebook password reset code. Without 2FA, a stolen password is all an attacker needs. With 2FA enabled, that same password becomes useless to anyone who does not also possess your phone or security key. Enabling 2FA is the single most effective step you can take to secure your Facebook account.

How to Enable 2FA on Facebook

1. Log in to facebook.com and click your profile picture in the top right.
2. Click Settings & privacy → Settings.
3. In the left menu, click Security and Login.
4. Under "Two-factor authentication", click Edit next to "Use two-factor authentication".
5. Click Get Started.
6. Choose your preferred method: Authentication app, Text message (SMS), or Security key.
7. For the authenticator app: follow the prompts to scan the QR code with your app, enter the 6-digit confirmation code, then click Finish.
8. Facebook will show you a set of recovery codes. Save these immediately.

Facebook's Two-Factor Authentication Methods

Authenticator App

This is the recommended method. Any TOTP-compatible app works: Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and others. After signing in with your password, Facebook asks for the current 6-digit code from your app. Codes refresh every 30 seconds and work offline.

Text Message (SMS)

Facebook sends a code to your registered phone number. This is convenient but less secure than an authenticator app. If you are already using SMS 2FA, consider switching to an authenticator app for better protection.

Security Keys

Facebook supports hardware security keys (FIDO2/WebAuthn) such as YubiKey. These provide the strongest protection available, particularly against phishing. When you sign in, you tap or insert the key instead of entering a code. Security keys are recommended for accounts with large followings or those used for business purposes.

Facebook Login Alerts

Separate from 2FA, Facebook can notify you whenever your account is signed in from an unrecognised device or browser. Enable this under Security and Login → Setting up extra security → Get alerts about unrecognized logins. This does not block a sign-in, but gives you early warning of unauthorised access.

Setting Up Multiple 2FA Methods

Facebook allows you to register more than one 2FA method. It is a good idea to configure both an authenticator app and SMS as a fallback, or register both an authenticator app and a hardware key. Multiple methods ensure you are not locked out if you lose one device.

Using Trusted Contacts as a Recovery Option

Facebook has a feature called Trusted Contacts that allows you to designate 3 to 5 friends who can help you recover your account if you are locked out. Each friend receives a portion of a recovery code. This is a useful backup but requires your trusted contacts to be active Facebook users and responsive. Set it up in Settings → Security and Login → Choose 3 to 5 friends to contact if you get locked out.

Lost Access to Facebook 2FA?

Use a saved recovery code if you have one. If not, Facebook provides several fallback options on the sign-in screen: approved devices, trusted contacts, and identity recovery. The process involves confirming your identity through photos, government ID, or contacts. Recovery can take anywhere from a few minutes to several days depending on which method you use.

Facebook 2FA Methods Compared

Facebook offers several two-factor authentication methods, each with different trade-offs between security and convenience:

• Authenticator App (TOTP) — Codes generated on your device, works offline, immune to SIM swapping. Best balance of security and convenience for most users.
• SMS Text Message — Codes sent via text to your phone. Convenient but vulnerable to SIM swapping and carrier-level interception. Only use if you cannot install an authenticator app.
• Hardware Security Key — FIDO2/WebAuthn keys like YubiKey. Phishing-resistant and immune to remote attack. Best for high-value accounts but requires purchasing a physical key.
• Recovery Codes — One-time use codes generated during setup. Not a primary method but an essential fallback when you lose access to your device.

You can combine multiple methods for the best protection. For example, use an authenticator app as your primary method with a hardware key as backup.

Troubleshooting Common Issues

2FA Code Not Working

If your authenticator app code is rejected, first check that your phone's date and time are set correctly. TOTP codes depend on accurate time synchronisation. On most phones, enabling automatic date and time will resolve this. If you recently reset your phone, you may need to re-add Facebook to your authenticator app.

Lost Your Phone

Use a recovery code from the set you saved during initial setup. If you do not have recovery codes, visit Facebook's identity recovery page at facebook.com/identify. Facebook will guide you through verifying your identity using a previously trusted device or by submitting a photo of your government-issued ID.

SMS Codes Not Arriving

Ensure your phone number is correct in Facebook's settings. Check that you have cellular reception and that you have not blocked Facebook's sender number. If SMS still fails, switch to an authenticator app as your primary 2FA method — it works without cellular signal.

Changed Phone Number

If you changed your phone number before setting up recovery codes, account recovery becomes more difficult. Update your phone number in Facebook's settings immediately before switching phones. If you are already locked out, use the identity recovery process with government ID verification.

Frequently Asked Questions

Is Facebook 2FA free?

Yes. Facebook two-factor authentication is completely free. Authenticator apps like Google Authenticator and Authy are also free. You only pay if you choose to buy a hardware security key.

Can I turn off Facebook 2FA?

Yes. Go to Settings → Security and Login → Two-factor authentication and click Turn Off. You will need to confirm your password. Disabling 2FA reduces your account security, so only do this if you are switching to a different 2FA method.

Does Facebook 2FA work on mobile apps?

Yes. Once 2FA is enabled in your Facebook settings, it applies to all sign-ins including the Facebook mobile app, Messenger, and facebook.com on any browser.

Can I use the same authenticator app for multiple Facebook accounts?

Yes. Most authenticator apps support multiple entries for the same service. You can add multiple Facebook accounts to apps like Google Authenticator, Authy, or 1Password by going through the 2FA setup process for each account.

What Facebook 2FA Feels Like After Setup

After the initial setup, most sign-ins are silent. Facebook remembers browsers and apps you confirm, and it only re-prompts when you log in from a new device, clear your cookies, or visit a sensitive area such as the security settings themselves. Every once in a while Facebook will challenge you even on a known device — usually after it detects unusual activity or a new location — and that prompt is a normal part of the system, not a sign that anything is wrong.

Keep in mind that 2FA applies to facebook.com, the mobile app, and Messenger together, but each app asks separately. Switching between them on a new phone may trigger two or three codes in a row. Also, some third-party logins — like an old game that uses "Log in with Facebook" — may still work without a code thanks to previously issued tokens; do not treat that as proof that 2FA is off.

How Facebook 2FA Affects Facebook Login and Connected Apps

Apps that connect through Facebook Login generally keep working after you enable 2FA because they rely on access tokens rather than your password. The exceptions are apps that ask Facebook to re-verify your identity: a device you have not used in months, or an app whose session expired, will bounce you through the code prompt before it lets you back in. That is expected behaviour, so do not disable 2FA to make an old app connect faster.

For apps that require "app passwords" — such as some mail and chat clients connected through Facebook — check Settings & Privacy → Settings → Password and security → Two-factor authentication. There you can generate a one-off app password instead of entering your normal password plus code. Remember to revoke app passwords for services you stop using; they remain valid until you remove them.