Instagram 2FA: how to set up an authenticator app

Instagram's two-factor authentication (2FA) is managed in Meta's Accounts Center, the settings area Instagram shares with Facebook and Threads. Meta is moving people to Meta Account settings over time, so you may see that name instead (Instagram). The 2FA choice is made per account, so your Instagram setting doesn't change Facebook (Meta).

2FA is optional. Login codes can come from an authentication app, which Instagram recommends, from text messages, or from WhatsApp once text messages are on. One limit shapes the steps: the app method "can only be turned on using the Instagram app for Android and iPhone" (Instagram). So on an iPhone, Instagram and your authenticator are usually on the same phone. This guide uses Authenticator App - Novaz, but any authenticator app works the same way.

How we checked this guide: the Instagram steps come from Instagram's Help Center and one Meta help page, linked below, which we read on October 20, 2026. help.instagram.com doesn't answer automated requests, so we read the current iPhone versions of the same articles on Meta's facebook.com/help/instagram, which uses UK spelling ("Accounts Centre"). For US wording we read archived copies of the help.instagram.com pages on web.archive.org, mostly their computer versions: the 2FA overview (saved September 30, 2026), the multiple-devices article (July 12, 2026), the backup code article (June 14, 2026), the authentication app article (June 13, 2026), and the hacked-account article (October 8, 2026, and its iPhone version from June 10, 2025). We haven't tested the steps on an Instagram account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

You have to be logged in first. In the Instagram app on your iPhone (Instagram, Instagram):

1. Tap Profile or your profile picture at the bottom right, then Menu at the top right.
2. Tap Accounts Center, then Password and security.
3. Tap Two-factor authentication and choose your Instagram account.
4. Tap Authentication app, then Next.
5. Link Novaz, as described below.
6. Back in Instagram, enter the confirmation code from Novaz.

The article on extra devices uses other names, Meta Account and Login and security (Instagram), so follow what your app shows.

Link Novaz on the same iPhone

The setup article stops at Next. The extra-devices article names the two choices on the linking screen, Copy key and View barcode/QR code (Instagram):

• Copy key: in Novaz, tap +, then Enter key manually. Type Instagram as the Service, add your username as the Account if you like, and paste into Setup key. See What is a 2FA setup key?
• View barcode/QR code: take a screenshot, then in Novaz tap + and Choose a photo. Delete the screenshot afterward, since it holds your key. See scanning a QR code on the same iPhone.

Instagram's pages mention 6-digit codes but not the interval or key length. If Novaz won't accept the pasted key, use the QR code.

Save your backup codes

Backup codes let you finish logging in when a login code can't reach you. Under Two-factor authentication, choose your account, then tap Additional methods and Backup codes. Get new codes cancels the old set (Instagram). You must be logged in to see them, and Instagram doesn't say how many you get.

Instagram suggests copying them or taking a screenshot. A screenshot on the iPhone that holds Novaz is no help if that phone is lost and you have no Novaz backup to restore. Keep the codes on paper or another device, as 2FA backup codes explains.

Instagram also lets you connect up to five devices, and the same key can go into more than one authenticator app (Instagram). An iPad with an authenticator app makes a good spare.

When Instagram asks for a code

Instagram asks when you log in from a device it doesn't recognize. Tap Trust this device to skip the code there next time, but not on a public or shared device (Instagram).

If Instagram rejects your code

Instagram's help doesn't cover rejected authenticator codes. The usual cause is a wrong iPhone clock: turn on Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Authenticator code not working? lists other causes.

Moving to a new iPhone

If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your codes keep working. Otherwise, Instagram's extra devices help. While you can still log in, add the new phone with Copy key or View barcode/QR code, check its code works, then remove the old one. Instagram says to tap your method, then Turn off, and that this doesn't log the device out. It doesn't say how to pick one device out of several (Instagram). See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use a backup code or another connected device. Instagram's pages describe no other route for a lost authentication app.

The closest is its article on hacked or locked-out accounts. It points to instagram.com/hacked in a web browser. In the app, tap Forgot password? on the login screen, then Can't reset your password? to ask for a security code or support, which Instagram says is done on a mobile device. The article doesn't say whether this gets you past 2FA. For proof, Instagram asks for a video selfie if the account has photos of you, and otherwise for the email or phone number you signed up with and the kind of device you used. The video is deleted within 30 days (Instagram). Replies come by email, with no timeframe given. For general steps, read Lost the phone with your authenticator app?

Turning 2FA off

Go back to Two-factor authentication, choose your account, pick the method to turn off, and follow the prompts (Instagram).

Official Instagram help

• Securing your Meta Account with two-factor authentication
• Use an authentication app for two-factor authentication on Instagram
• Turn two-factor authentication for multiple devices on or off
• How you can use a backup code on Instagram
• If you think that your Instagram profile has been hacked
• Settings you can manage across your accounts in an Accounts Center (Meta)