Loading page
About this tool
Enable app-based or security-key 2FA on X, save the backup code and drop the SMS fallback, with a readiness score.
This guide takes you through switching on two-factor authentication for an X (formerly Twitter) account under Settings and privacy, Security and account access, Security, Two-factor authentication — and then scores what is still exposed. X offers three methods there: security key, authentication app and text message, with text message restricted to paid subscribers since March 2023. The checklist also covers the single backup code, password reset protect, old sessions and the connected apps that keep working after a password change.
Open X (Twitter) 2FA Setup Guide on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
The text message option is gated behind a paid subscription, exactly as it is in the app.
Existing sessions and OAuth tokens from connected apps survive a password change — both are on the list.
X gives you one backup code, so the score stays capped until you have saved it.
X limited text-message 2FA to paid subscribers from 20 March 2023. On a free account the toggle is unavailable and you must use the authentication app or a security key instead — both are free and both are stronger than SMS.
Settings and privacy, then Security and account access, then Security, then Two-factor authentication. The same screen lists all three methods, and X lets you keep more than one enabled at the same time.
One. X issues a single backup code, which you can regenerate from the Two-factor authentication screen whenever you want a fresh one. Store it in a password manager or on paper rather than as a screenshot on the phone that holds your authenticator app.
No. Sessions that were already signed in stay signed in, and third-party apps keep working through their OAuth tokens. After enabling 2FA, go to Apps and sessions to log out of unknown devices and revoke connected apps you do not recognise. If you think the account was actually compromised, treat this as a starting point and contact X support.