Before you start
Make sure you can log in to the Facebook account you want to protect. You may need to enter your password again. If Accounts Center contains several profiles, select the correct Facebook account rather than a linked Instagram account.
Open Facebook’s 2FA settings
- In Facebook on the web, open your profile menu and choose Settings & privacy → Settings.
- Open Accounts Center → Password and security → Two-factor authentication.
- Select your Facebook account and choose Authentication app.
- Keep the setup screen open while you add its QR code or setup key to Sign In.
Add Facebook to Sign In
For verification codes on iPhone, we recommend Sign In, our authenticator app. It generates your codes on your device.
- If Facebook’s QR code is displayed on another screen, open Sign In and tap Add → Scan QR Code.
- If you are using only your iPhone and Facebook offers a manual setup key, copy it. In Sign In, choose Add → Enter Setup Key. Use Facebook for Service, a recognizable account label for Account, and paste the key into Key.
- Review the account and tap Add Account.
- Return to Facebook and enter the current six-digit code from Sign In. Complete the confirmation prompts and check that two-factor authentication is enabled.
If no manual key is available, open Facebook’s setup on a second screen to scan the QR code.
Keep the QR code and setup key private. They let an authenticator generate codes for your account.
Other supported methods
Facebook also supports compatible hardware security keys and text-message codes. A security key provides phishing resistance; check that it works with the device and browser you use.
SMS can be a fallback, but depends on access to your phone number and mobile service. Phone-number takeover and delivery failures are reasons to keep another recovery option available.
Save recovery codes
- Return to Accounts Center → Password and security → Two-factor authentication and select your Facebook account.
- Under Additional methods, open Recovery codes.
- Choose Get new codes if needed and save the codes privately, somewhere you can access without your phone.
Recovery codes are single-use. Keep your latest set and do not share them with anyone offering account help.
If you cannot log in
For a rejected authenticator code, confirm the Facebook account selected in Sign In, wait for a fresh code, and check your iPhone’s automatic date and time settings.
If your phone is unavailable, use a saved recovery code or another method already configured on the account. Follow the help options on Facebook’s login screen if those are unavailable; see the official troubleshooting link below. Do not assume recovery is guaranteed.