Instagram Backup Codes (and X, TikTok): Where to Find Them

Instagram backup codes are in Accounts Center > Password and security > Two-factor authentication > your account > Additional methods > Backup codes. Tapping "Get new codes" there cancels the old set. On X, go to Settings and privacy > Account > Security > Backup code. TikTok's help pages offer no backup codes. Your fallback there is a second verification method.

This guide is for anyone who has turned on two-factor authentication (2FA) and wants a way back in if their phone dies, plus buyers and sellers handing an account from one person to another. It covers the exact menu paths, how many codes you get, when old codes stop working, and what has to be reset when an account changes owners. Menu paths and rules are as of October 2026.

Key takeaways

• Instagram shows backup codes only while you are logged in, so you need to save them before you lose access.
• Tapping "Get new codes" on Instagram cancels your current backup codes and replaces them with a new set.
• X shows one backup code at a time, allows up to five active backup codes at once, and returns an error for inactive or out-of-order codes.
• TikTok's official 2-step verification options are phone, email and an authenticator app, and you must pick at least two, so the second method is your backup.
• Backup codes do not protect a new owner if the previous owner still controls the recovery email, phone number, authenticator app or a security key.
• After an account handover, the buyer should replace every login and recovery method and regenerate backup codes before confirming the deal.

Backup codes at a glance: Instagram vs X vs TikTok

The three platforms handle backup codes very differently. Instagram gives you a list, X gives you single codes, and TikTok relies on a second verification method instead. Most guides cover one platform and assume the others work the same way, which leaves readers with the wrong expectations.

Where are Instagram backup codes?

Instagram backup codes sit inside the two-factor authentication settings in Accounts Center, under "Additional methods." According to Instagram's help page on backup codes (viewed October 2026), the codes let you finish a two-factor login when a code can't reach you because of connectivity or delivery problems.

Two things trip people up. First, Meta is gradually moving users to Meta Accounts, so you may see "Meta Account settings" where others see "Accounts Center." Second, labels change between app versions. You might see "Settings and activity" or "Settings and privacy," and "More options" instead of "Additional methods." The structure stays the same.

Instagram backup codes on desktop

• Step 1: Log in at instagram.com and click More (the hamburger icon, bottom left).
• Step 2: Click Settings, then Accounts Center (or Meta Account settings).
• Step 3: Open Password and security, then Two-factor authentication.
• Step 4: Choose the account, open Additional methods, then Backup codes.
• Step 5: Copy the codes or save them somewhere safe. Instagram suggests copying them to the clipboard, taking a screenshot or saving them some other way.

Instagram backup codes in the app

In the app, go to your profile, tap the menu, open your settings screen and find Accounts Center. From there the path is the same: Password and security > Two-factor authentication > your account > Additional methods > Backup codes.

What happens to old Instagram codes when you get new ones?

They stop working. Instagram's help page describes the "Get new codes" button as a way to "cancel your current backup codes and get a new set." Only the newest set matters. Each code is generally single-use, so cross off codes as you use them and regenerate when you're running low.

One correction to a common claim: some guides say Instagram shows codes only at setup or when you regenerate them. Instagram's own help page says you can view your list while logged in. The catch is the login requirement. If you're already locked out, the codes screen is out of reach.

If you also use Threads with two-factor authentication, Instagram Help has a separate article on Threads backup codes. Check it rather than assuming your Instagram codes cover Threads.

How do you get a backup code on X (Twitter)?

X creates a backup code automatically when you turn on 2FA in the iOS or Android app. You can generate a new one at any time in Settings and privacy > Account > Security > Backup code, or on x.com. According to X's two-factor authentication guide, the code appears on a confirmation screen after you enter the confirmation code. X recommends keeping a screenshot in case you lose your phone or change your number.

• Step 1: Open the X app and tap Settings and privacy.
• Step 2: Tap Account, then Security.
• Step 3: Tap Backup code to see or generate a code.
• Step 4: Write it down, print it or screenshot it, as X suggests.

X backup code rules most guides get wrong

X does not work like Instagram. Several popular guides describe a "set" of X codes, but X shows a single code and lets you have up to five active backup codes at any given time. According to X's help page on login authentication (updated late September 2026), using an inactive code or using codes out of order produces an error. At that point you need to generate a new backup code to log in.

X also says backup codes are not the same as temporary passwords. They solve different problems. One place a temporary password comes into play is iOS: X recommends an encrypted device backup to keep the X app's key, because iCloud backups alone usually don't keep it. Without that key, you may need a temporary password generated on x.com to get back in.

Security keys change the picture. If you add a security key to X, you no longer need another backup method, and the key can be your only 2FA method. That's strong protection, and it also means whoever holds that physical key, plus the password, can get past 2FA.

Does TikTok have backup codes?

TikTok's official help material doesn't offer backup codes for 2-step verification. Your backup is a second verification method. TikTok's guide to turning on 2-step verification gives the path as Profile > Menu (☰) > Settings and privacy > Security & permissions > 2-step verification. You must choose at least two of three methods: Phone, Email or Authenticator.

The TikTok pages we checked are business, seller and ads pages, not the consumer help page, so treat this as the documented picture as of October 2026. The TikTok Ads Help Center lists the same three options for TikTok for Business accounts: SMS, email, or a third-party authenticator app such as Google Authenticator. Older guides that list "password" as a method are out of date.

For TikTok Shop Business Center, only Admins can turn on 2-step verification. They can require it for No One, Admins Only or Everyone.

The practical point: pick two methods that fail independently. Phone plus an authenticator app on that same phone is weak, because losing the phone takes out both. Email plus an authenticator, or a phone number plus email you can reach from any device, is sturdier.

Lost your phone or logged out: what works on each platform?

Your options depend on what you saved before things went wrong. Here is what each platform documents.

• X: If you lose your phone, you can turn off 2FA from the old phone or from x.com if you still have an open web session. If you have neither, log in to x.com with your backup code. If your phone number or carrier changed and you're logged out, X says to log in with a backup code and then update your settings.
• Instagram: Backup codes are built for exactly this situation, but only if you saved them earlier. You can't view or generate them while logged out, so without a saved code you depend on whatever recovery options Instagram offers at the login screen.
• TikTok: TikTok's business help pages say that to log in with 2-step verification on, you need access to one of the methods you set up: the email address, phone number or authenticator app. Having two methods gives you a fallback if one is lost.

Backup codes when an account changes hands

When an account changes owners, backup codes become a liability unless the buyer replaces them. Any code the seller saved, and any recovery method the seller still controls, is a way back into the account.

Be clear about the risk first. Instagram, X and TikTok terms generally restrict selling or transferring accounts, and you should read each platform's current terms before any deal. A handover can put the account at risk no matter how carefully 2FA is managed. What follows is security hygiene for reducing lockout and takeover risk. It is not something the platforms endorse.

What the seller should hand over

The seller should provide the login details plus a working backup code (or the current Instagram list), so the buyer can get past 2FA on a new device without the seller's phone. The seller should also be ready to cooperate while the buyer swaps the email, phone and authenticator. For the X-specific sequence, see our X account transfer ownership checklist.

Why regenerating codes isn't enough on its own

Backup codes are only one key to the account. If the previous owner still controls the recovery email, the phone number, the authenticator app or a security key, new backup codes will not keep them out.

On Instagram, "Get new codes" cancels the old set in one tap, which is clean. On X it's less certain. Because up to five codes can be active at once, generating a new code may not kill codes the seller saved. X's help pages don't document a "revoke all codes" option. As a precaution, turn 2FA off and back on with your own methods, then generate a fresh code. We haven't confirmed exactly what X clears when you do this, so pair it with replacing every other method.

TikTok has no codes to rotate, so the whole job is replacing the phone, email and authenticator. Our guide on selling a TikTok account covers the wider transfer risks.

Buyer's 2FA reset checklist

• Step 1: Log in with the credentials and backup code the seller provided, before you confirm the deal.
• Step 2: Change the password to one only you know.
• Step 3: Replace the email address and phone number with ones you control. For Instagram, follow our guide to changing the email and phone on a bought account.
• Step 4: Remove the seller's authenticator app and set up your own, so the seller's copy of the setup key stops working.
• Step 5: On X, remove any security key you don't physically own.
• Step 6: Regenerate backup codes. On Instagram, tap "Get new codes." On X, turn 2FA off and on with your own methods, then generate a new code. On TikTok, confirm both chosen methods are yours.
• Step 7: Review any list of logged-in devices or sessions the platform shows and remove ones that aren't yours.
• Step 8: Save the new codes offline, then log out and back in once to prove the new setup works.

Where should you store backup codes?

Store backup codes somewhere you can reach without the phone they protect. A password manager entry for the account is the most practical choice, and a printed copy in a drawer is a good second.

Both Instagram and X suggest screenshots, which is fine as long as you think about where screenshots go. If your photo library syncs to the cloud, anyone with access to that account can read your codes. Never keep codes in the same email inbox that serves as the account's recovery address, and treat them like passwords: don't paste them into chats, notes apps you share, or support tickets.

Handling 2FA inside a PlayerSells deal

On PlayerSells, the 2FA reset fits into the escrow sequence. Every deal follows a fixed path: offer sent, accepted, payment pending, paid, delivered, buyer confirmed, completed. The buyer pays PlayerSells, the money is held, and the seller is paid only after the buyer confirms the account was delivered as described.

That gives the buyer a window. After "delivered" and before "buyer confirmed," work through the checklist above: log in, swap the email and phone, replace the authenticator, remove foreign security keys and regenerate codes. If a backup code fails or the seller won't release a recovery method, either side can open a dispute before completion. A human moderator reviews it, and the money stays held while the dispute is open. Every listing is also reviewed by a person before it goes live. See how a PlayerSells deal works and the safety guidance for the full process.

Frequently asked questions

Where do I find my Instagram backup codes if I'm logged out?

You can't view them while logged out. Instagram requires you to be logged in to see your list of codes or get a new one. That's why you should save them as soon as you turn on 2FA, ideally in a password manager or on paper.

How many backup codes does Instagram give you?

Instagram gives you a short list of codes, but its official help page doesn't state a fixed number. Third-party guides disagree on the count, so check the list in your own account. What matters more is that generating a new set cancels the old one.

Why is my Twitter backup code not working?

The code is most likely inactive or being used out of order. X returns an error in both cases. You'll need to generate a new backup code, which you can do from an existing logged-in session in the app or on x.com.

Is a Twitter backup code the same as a temporary password?

No. X says backup codes and temporary passwords are different things. A backup code gets you past 2FA when your usual method is unavailable, while a temporary password generated on x.com can help iOS users whose app key wasn't preserved in a backup.

How do I log in to TikTok if I lost my phone with 2-step verification on?

Use one of your other verification methods. TikTok makes you choose at least two of phone, email and authenticator app, so if the phone is gone, verify through email or an authenticator on another device. If all your methods were on the lost phone, you'll need to contact TikTok support.

Do Instagram backup codes work for Threads?

Don't assume they do. Instagram Help publishes a separate article on backup codes for Threads accounts that use two-factor authentication. Check that page and save Threads codes separately if your Threads account uses 2FA.

Bottom line: save codes now, reset them after any handover

Take two minutes today. Save your Instagram codes and your X backup code somewhere off your phone, and make sure your two TikTok methods don't both depend on one device. Once you're locked out of Instagram, the codes screen is out of reach.

If you're taking over an account, the codes the seller handed you are a starting point, not protection. Replace every recovery method, regenerate the codes, and only then confirm the deal. For X accounts, our guide to the first 90 days after buying covers what comes next.