X 2FA setup
X (formerly Twitter) offers three 2FA factors — SMS (Premium-only since 2023), authenticator app (TOTP), and security keys — and the app-based one is the free, portable option for every account. A browser authenticator works perfectly — you just have to catch the setup key behind the QR.
Fact-checked against X's official documentation · last reviewed 9 November 2026 · how we review guides
Open the generator for XStep by step
- 01
Open security settings
Sign in at x.com → “More” in the sidebar → Settings and privacy → Security and account access → Security → Two-factor authentication.
- 02
Pick “Authentication app”
Choose the app option (not SMS — X restricts SMS to Premium accounts, and app codes are safer against SIM swaps anyway). Confirm with your current password if prompted.
- 03
Grab the setup key
X shows a QR scan screen. Look for the small copy/manual-entry link beneath the QR to get the Base32 secret, or screenshot the QR and paste it into the generator — both routes work.
- 04
Generate and verify
Paste the key into 2facounter.com, copy the live 6-digit code, and enter it in X’s confirm dialog. X remembers the enrollment as “Authenticator app”.
- 05
Screenshot the confirmation QR, too
After verifying, X may display a one-time QR “for other devices”. If yours shows it, scan it back into the generator or screenshot it — it lets you restore the same key into any app later without re-enrollment.
- 06
Store backups
Save the Base32 key (and that confirmation QR) encrypted in a password manager, and note X’s single-use backup code list if prompted.
X-specific traps that trip people up
The phone-number gate
Accounts without a verified phone number have historically found the two-factor menu hidden — even for the app-based option. Verify a number is registered on the account before you try to enroll. The number doesn’t become your 2FA (app codes are a separate factor); it just has to exist for the section to appear.
Why the SMS factor is the one to skip
X restricts SMS 2FA to Premium subscribers, and SMS is also the weakest factor in the stack: a SIM-swap attacker reads those codes without touching your device. The third option, security keys, is the phishing-resistant one if you already own a hardware key or passkey — but TOTP is the factor that adds a real, free second factor computed on your side and portable to any device with the key.
The post-enrollment QR is your backup, not decoration
When you finish verifying, X shows a confirmation screen that may include a one-time QR labelled “for other devices”. If yours shows it, screenshot it into your password-manager vault (or keep the Base32 key next to it) so you can restore the enrollment into a new phone app or browser later — without re-enrolling or contacting X support.
FAQ
Why does X require a phone number for 2FA?
Accounts without a verified phone number have historically not seen the 2FA section — even when they only want the app-based option. The browser authenticator replaces the need for an authenticator *app*, not the number requirement.
Which of X’s three 2FA options is the safe one?
A hardware security key or passkey is the phishing-resistant pick if you have one. Without hardware, TOTP is the factor to choose: SMS is vulnerable to SIM-swap attacks and text-message interception (and Premium-only anyway), while app-based codes change every 30 seconds and are computed locally.
Do the codes work across multiple devices?
Yes — TOTP is deterministic. The same secret pasted in a browser, a phone app, or a second browser profile always produces the same code at the same 30-second step.