Facebook Two-Factor Authentication: Codes, Backups and Fixes

Facebook two-factor authentication adds a second code to your sign-in. The safest setup is an authenticator app plus saved backup codes, with text messages only as a fallback.

What Facebook offers

Two-factor is in Accounts Center › Password and security, with an authenticator app, text message or security key, plus recovery codes. A number can be confirmed on only one Facebook account at a time.

Two-factor methods compared

Turn it on the safe way

1. Open Facebook's security settings and choose two-factor or two-step verification.
2. Pick the authenticator app option if there is one, and scan the QR code with an app such as Google Authenticator or Microsoft Authenticator.
3. Enter the 6-digit code the app shows to confirm.
4. Save the backup or recovery codes somewhere offline, such as a password manager or on paper.
5. Add text messages only as a backup method.

When the code does not work or arrive

• Authenticator codes depend on the clock: set your phone's date and time to automatic.
• Text codes can land in spam or "unknown senders"; check there before asking again.
• Ask for a new text code once, then wait; repeated requests can lock you out for a while.
• Use a backup code if nothing else works.

Lost your phone?

Start at facebook.com/login/identify; Facebook can confirm you by email and may ask for an ID or a video selfie. If you have neither the phone nor the codes, Facebook's account recovery process is the way back, and it can take days.

Should you use a second number for two-factor?

Prefer an authenticator app: it works without signal and cannot be stolen by a SIM swap. If Facebook only offers text messages and you want them on a separate number, use a number you keep for months, never a one-time number, because that number goes to someone else afterwards. A rental number for Facebook stays yours for the days you pay for.

FAQ

Is text-message two-factor on Facebook safe?

It is much better than no two-factor, but an authenticator app or security key is safer, because text codes can be intercepted after a SIM swap.

What are backup codes?

One-time codes you save when you turn on two-factor. Each works once and gets you in when your phone is not available.

Can I turn off two-factor on Facebook?

Yes, from the security settings after you sign in, but it makes the account easier to take over.

What if I lost my authenticator app?

Sign in with a backup code and set it up again. Without codes, use the account recovery process.

Can I move my authenticator to a new phone?

Yes: most authenticator apps can transfer or back up accounts. Do it before you reset the old phone.

Why does Facebook ask for a code every time?

Clearing cookies or using private browsing makes the device look new. Allow cookies and choose to trust the device if offered.

Related: Facebook number · Facebook account recovery · create facebook account without phone number · facebook marketplace phone verification what it wants and wh · verification code not received on any app.