How to Change Your Instagram Password (and Keep It Safe)

Your password is the front door to your Instagram account, so it is worth changing when it feels weak, when you have used it elsewhere, or the moment you suspect anything is off. As of 2026 password controls live in Meta’s Accounts Center, shared across Instagram and Facebook. This guide covers changing it on mobile and web, resetting a forgotten one safely, and — just as important — the real security habits that keep your account yours. Because this is StealthGram, we will also be blunt about the scams that target exactly this moment.

Change your password in the Instagram app

1. Open Instagram, go to your profile, and tap the menu (☰).
2. Tap Settings and activity.
3. Open Accounts Center, then Password and security.
4. Tap Change password and select your Instagram account.
5. Enter your current password, then a new password twice, and tap Change password.

Changing your password is also the fastest way to kick out anyone who should not be there — it ends other active sessions.

Change or reset it on the web

1. Go to instagram.com and sign in.
2. Visit Accounts Center > Password and security > Change password, or go straight to the password page in Settings.
3. Enter your old and new passwords and save.
4. Forgot your password? On the login screen tap Forgot password?, enter your username, email or phone number, and open the reset link Instagram sends. Set a fresh password from there.

Build a password worth having

Changing the password only helps if the new one is genuinely strong. Aim for:

Do	Don’t
Use 12+ characters, or a long passphrase	Use names, birthdays or “password123”
Make it unique to Instagram	Reuse a password from another site
Let a password manager generate/store it	Keep it in a note or text-to-self
Mix words, numbers and symbols	Share it with anyone, ever

Reused passwords are one of the most common ways accounts get hijacked: when some unrelated website is breached, attackers try those same email-and-password pairs on Instagram. A unique password shuts that door. If remembering a different strong password for every service sounds impossible, that is exactly what a password manager is for — it generates and stores long random passwords so you only ever have to remember one master passphrase. Most phones now include one for free, and it will also warn you if a password you use has turned up in a known breach, giving you a clear prompt to change it.

Turn on two-factor authentication

A strong password is step one; two-factor authentication (2FA) is the step that saves you if the password ever leaks. With 2FA on, logging in from a new device also needs a one-time code, so a stolen password alone is not enough.

1. Go to Accounts Center > Password and security > Two-factor authentication.
2. Select your account and choose a method — an authenticator app is the most secure, with SMS as a fallback.
3. Follow the prompts and save your backup codes somewhere safe.

Spot the phishing before it gets you

Password changes are a favourite hunting ground for scammers, because a fake “secure your account” message feels urgent. Keep these rules:

• Instagram never asks for your password by DM or email. Anyone who does is phishing.
• Beware fake “Instagram Support” or “Copyright Team” messages warning your account will be deleted unless you “verify” via a link. These lead to lookalike login pages that steal your password. Real notices appear inside the app.
• Do not click reset links you did not request. If a reset email arrives out of nowhere, open the app directly and change your password there instead.
• Log in only in the official app or by typing instagram.com yourself — not through links.
• Verify security emails in Settings > Security > Emails from Instagram, which lists genuine messages Instagram has sent.

If you think someone else got in, change your password immediately, review “Where you’re logged in” to end unknown sessions, and turn on 2FA. Our Instagram safety and privacy guide goes deeper on locking things down, and if you are truly locked out, read our honest take on how to contact Instagram support — and why to avoid paid “account recovery” services.

When should you change your password?

You do not need to rotate your password on a schedule the way old advice used to insist — a long, unique password protected by two-factor authentication is strong for a long time. What matters more is changing it promptly at the right moments:

• Right away if you suspect anyone has your login, or you spot an unfamiliar device in “Where you’re logged in”.
• Immediately if you ever typed your password into a page you later realised was fake, or reused it on a site that got breached.
• Soon if you shared it with someone (an ex, a former employee, a “social media manager”) and that trust has ended.
• Whenever it is weak — short, guessable, or reused anywhere else.

Outside of those triggers, obsessive monthly changes tend to push people toward weaker, easier-to-remember passwords, which is counterproductive. One strong password plus 2FA beats a rotating parade of weak ones.

If you think you have already been hacked

Speed matters here. Work through this quickly and in order:

1. Change your password using the steps above — this ends other active sessions.
2. Open Accounts Center > Password and security > Where you’re logged in and remove any device or location you do not recognise.
3. Turn on two-factor authentication if it is not already on.
4. Check your email and phone number on the account are still yours — attackers often swap these to lock you out.
5. If you cannot get in at all, use Instagram’s official recovery flow — our guide on contacting Instagram support explains the honest, free path and warns against paid “recovery” scams.

A word on “password checker” and recovery tools

You do not need any third-party app to change your Instagram password, and you should never enter your login into one. Tools that promise to “check if your Instagram is hacked”, “recover your account fast” or “test your password strength” by having you sign in are the very trap they claim to protect you from. The only place to manage your password is inside Instagram’s own settings. Our own privacy tools run entirely in your browser and never ask for a password — that is the bar every tool should meet.

Quick recap

Change your Instagram password in Accounts Center > Password and security > Change password, or reset a forgotten one with the Forgot password? link that Instagram itself sends. Make it long, unique and stored in a password manager, switch on two-factor authentication, and treat every “verify your account” link with suspicion. Those habits — not any app — are what keep your account safe. Menus shift over time, so wording may differ on your version, and Instagram may change this in future updates.

Frequently asked questions

How do I change my Instagram password in the app?

Go to your profile > menu > Settings and activity > Accounts Center > Password and security > Change password, pick your account, enter your current password and a new one, then save. You can also reach it from Settings > Security.

How do I reset my password if I forgot it?

On the login screen tap “Forgot password?”, enter your username, email or phone, and follow the reset link Instagram sends. Only ever use the link that arrives from Instagram itself — never a reset link someone sends you in a DM.

What makes a strong Instagram password?

A long, unique passphrase you do not use anywhere else — ideally 12+ characters mixing words, numbers and symbols, or a random string from a password manager. Never reuse a password from another site, since breaches elsewhere are a top way accounts get hijacked.

Should I turn on two-factor authentication?

Absolutely. Two-factor authentication (2FA) adds a second step at login, so even someone with your password cannot get in. Use an authenticator app or your phone number under Accounts Center > Password and security > Two-factor authentication.

Instagram emailed me about a password reset I did not request — what do I do?

If you did not request it, do not panic and do not click any link in the email. Open the Instagram app directly and change your password there, and check “Where you’re logged in”. Genuine Instagram security emails can also be verified in Settings > Security > Emails from Instagram.

How can I tell a fake Instagram login page from the real one?

Real logins happen only in the official app or on instagram.com. Be suspicious of any link in a DM or email asking you to “verify”, “confirm” or “secure” your account. Fake pages copy Instagram’s look to steal your password — when in doubt, type instagram.com yourself.