How to Recover a Hacked Twitter/X Account

Last updated: October 10, 2026

Five-step flowchart for recovering a hacked X (Twitter) account

If your X account (formerly Twitter) starts posting things you never wrote, sends direct messages you did not send, or suddenly refuses your password, act quickly. A hijacked account can be used to spread scams under your name, and the longer it stays compromised, the more harm it can do to your followers and your reputation.

This guide follows the steps in X's own Help Center, adds the settings that most recovery guides leave out (logging out other sessions, password reset protection, backup codes and passkeys), and explains exactly what to do if you are completely locked out. X changes its menus from time to time, so if a label differs slightly on your screen, look for the nearest match in Settings and privacy.

Quick Guide: Which Situation Are You In?

Your situation	What to do first	Section below
You can still log in, but see posts, DMs or follows you didn't make	Change your password, then log out all other sessions and remove unknown apps	Steps 1 to 4
You are logged out, but still control the email or phone on the account	Use "Forgot password" on the login page and reset by email or SMS	Step 1
The attacker changed the email and password	Submit a support request from the email address that used to be on the account	If You Cannot Sign In
You lost the phone you use for two-factor authentication	Log in with a backup code, or contact X support if you have none	Lost Your Two-Factor Phone
You no longer have access to the account's email and have no verified phone	Recover the email account with your email provider first	Lost Access to Your Email
Strange activity, but you think a connected app caused it	Revoke the app's access and change your password	Step 3

How to Tell Whether Your Account Is Compromised

X's help page on compromised accounts lists these signs:

posts you did not write;
direct messages you did not send;
other behavior you did not approve, such as following, unfollowing or blocking accounts;
a notification from X saying your account may be compromised;
a notification that your account information has changed when you did not change it;
a password that no longer works and a prompt to reset it.

The FTC adds one more: a notification that someone logged in from a device you don't recognize or a location you're not at. X also points out that unexpected activity does not always mean a hack. A third-party app connected to your account can have a bug and behave strangely. The steps below deal with both cases, because X says changing your password and revoking app connections will stop the behavior either way.

Before you start, the FTC recommends making sure your computer's security software is up to date and running a scan. If you change your password on a computer that has password-stealing malware, the attacker may simply capture the new one.

Step 1: Change Your Password

If you can still sign in, change the password immediately from the Password section of your settings. If you are logged out, use the "Forgot password" link on the login page and follow the instructions. X asks you to choose a strong password you haven't used before. A password manager can create and store it for you.

Step 2: Secure the Email Address on the Account

Your email is the master key. X asks you to make sure that the email address attached to your account is secure and that you are the only one with access to it. If an attacker controls your email, they can keep resetting your X password. Check that email account for unknown forwarding rules, recent sign-ins and recovery details. See our guide on how to tell whether your email has been hacked if you are unsure, and secure the email account before going further. If your email is Gmail, our guide to recovering a hacked Google account walks through it.

Look in the inbox for any message from X about an email or password change you did not make. Be careful, though, because attackers also send fake "X security" emails. According to X's page on fake emails:

X only sends email from @x.com or @e.x.com addresses.
X will never send emails with attachments.
X will never ask for your password by email, direct message or reply.
If X resets your password because it thinks you were hacked, the link it sends will always be on the x.com website.

Step 3: Revoke Third-Party Apps and Log Out Other Sessions

This step is what actually kicks the attacker out. Changing a password does not always end sessions that are already open.

Log out other sessions. In Settings and privacy, open the Apps and sessions section. Under Sessions, X shows every active login with its location and time. Click Log out next to any session you don't recognize, or Log out all other sessions to end them all at once. X notes that logging out a session stops further actions from it, but may not delete data, such as direct messages, already cached on that device.
Revoke unknown apps. In the same Apps and sessions area, review connected apps and revoke access for any you don't recognize or no longer use. According to X's page on third-party apps, depending on its permissions an app may be able to read your posts, post on your behalf, update your profile, access your direct messages or see your email address. X recommends reviewing connected apps regularly.

X lists malicious third-party apps and websites as one way accounts get compromised, especially if you ever gave a tool your username and password. Be especially wary of anything that promised followers, money or verification. X warns specifically against giving your login to third parties making those promises.

Step 4: Update Your Password in Trusted Apps

If a trusted app you still use logs in with your X password, update the password inside that app too. X notes that if you don't, repeated failed login attempts from that app could temporarily lock you out of your account.

Step 5: Check Contact Details, Settings and Content

Check the phone number and email on the account, and remove any you don't recognize.
Turn on password reset protection. X's account security tips recommend requiring your email address and phone number to request a password reset link or code. When this setting is on, anyone trying to reset your password must enter that information first. You'll find it under Settings and privacy, then Account, then Security, then Password reset protection.
Review who you follow, your direct messages, your profile information and any saved drafts or scheduled posts.
X recommends deleting any unwanted posts that were published while your account was compromised. Consider posting a short note to explain, so followers do not click any suspicious links.

Step 6: Turn On Two-Factor Authentication (and Consider a Passkey)

X describes two-factor authentication as a critical security feature that adds an extra layer of protection and significantly reduces the risk of unauthorized access. According to X's two-factor authentication guide, go to Settings and privacy, then Security and account access, then Security, then Two-factor authentication. X offers three methods:

Method on X	How it works	Things to know
Text message	A six-digit code is texted to your phone at login	Easiest to start with, but codes sent by SMS can be intercepted if someone takes over your number in a SIM swap. X shows a backup code during setup.
Authentication app	An app such as Google Authenticator generates codes after you scan a QR code	Not tied to your phone number. Back up your authenticator app so a lost phone does not lock you out.
Security key	You insert a physical key into USB or connect it over NFC or Bluetooth, then touch it	X says a security key can be your only two-factor method, with no other method turned on. Requires a recent version of a supported browser such as Chrome, Edge, Firefox, Opera or Safari.

Our article comparing SMS, app and security-key two-factor authentication explains the trade-offs in more depth.

Save your backup code. X recommends writing down, printing or taking a screenshot of your backup code and keeping it somewhere safe. If you lose your phone or change your number, this code gets you back in.

Temporary passwords. With two-factor turned on, some other apps and devices that ask for your X password will need a temporary password instead, which you can generate under Two-factor authentication, then Additional methods. X says temporary passwords expire after one hour.

Passkeys. X also supports passkeys on its iOS and Android apps. According to X's passkey page, you add one under Settings and privacy, then Security and account access, then Security, then Additional password protection, then Passkey. X explains that the private key stays on your device and is never shared with X, which makes passkeys less susceptible to phishing. A passkey is optional on X, and you can still sign in with your password.

If You Cannot Sign In at All

If a password reset does not work, or the attacker changed the email address, the recovery route is X support:

Go to the X Help Center by typing help.x.com yourself, and use the account access form for a hacked or compromised account.
Use the email address that is associated with the compromised account when you submit the request. X says it will send further information and instructions to that address.
Include both your username and the date you last had access to the account, as X asks.
Check your spam folder for replies, and keep your request details in case you need to follow up.

Lost Your Two-Factor Phone

According to X's help on two-factor login problems:

If you have a backup code, use it to log in, then update your phone settings.
If you are logged out and have no active backup code, contact X's support team.
You can have up to five active backup codes at a time. Use them in the order you generated them, because X says using a code out of order invalidates the earlier ones.
Backup codes only work for logging in to X itself. Third-party apps linked to your account need a temporary password instead.
Planning to switch phones? X suggests backing up your old phone first so you can restore your app session. On iPhone, X recommends an encrypted backup to preserve the app key.

Lost Access to Your Email

X's page on email access problems says to contact your email provider to regain access to the email account first, then request a new X password. If your phone number is verified on the account, you can enter it on the password reset page and reset by SMS instead.

Be prepared for a hard limit: X says that if you have no access to either the account's email address or a verified phone number, it is unable to continue troubleshooting, because those checks stop it from giving account information to the wrong person. That is why keeping your email secure and your phone number current matters before anything goes wrong.

Beware of "Account Recovery" Scams

Be wary of anyone offering to "recover" your account for a fee, particularly in direct messages, comments, replies or ads. Legitimate help comes from the platform itself. X says it will never ask for your password by email, direct message or reply. Never give your password, verification codes or backup codes to a third party, and never pay someone who promises to unlock an account.

Clean Up: Look for How It Happened

X lists several ways accounts get compromised: giving your username and password to a malicious third-party app or website, a weak password, viruses or malware on your computer that collect passwords, or using a compromised network. Ask yourself:

Did you click a login link in an email, direct message or comment recently? Phishing pages copy sign-in screens. X advises always making sure you're on x.com before entering your login details.
Did you use the same password on another site that was breached? Our guide on data breaches shows how to check.
Did you authorize a "follower tracker", giveaway or analytics tool?
Could malware be on your computer?

X advises scanning your computers for viruses and malware, especially if unauthorized activity continues after you change your password, and installing security updates for your operating system and apps. Also change the password on any other account that shared it, starting with email, banking and other social networks. Unique passwords are what stop one breach from becoming several. It is also worth reviewing which devices and apps have access to your other important accounts.

Protect Your Followers and Business Accounts

The FTC recommends telling your contacts about the hack and asking them not to click links in messages from you and to ignore pleas for help or money. Use another channel, such as a different account or website, if the attacker sent messages or links.
If the account is used for work, tell colleagues and any brand partners, and review who has access.
Limit the number of people who know the password. X suggests using its Delegate feature if several people need to manage one account, instead of sharing the login.
Report scam posts or messages that were sent from the account.

Frequently Asked Questions

How long does account recovery take?

It varies. A password reset can take minutes if you still control your email or verified phone. A support request can take longer, so keep checking the email address you used.

Can I recover the account if the hacker changed my email?

Possibly, through a support request. Submit it from the email address that used to be on the account, and include your username and the date you last had access.

Does changing my password log the hacker out?

Do not assume so. After changing it, open Apps and sessions and use "Log out all other sessions," then revoke any apps you don't recognize.

How do I know an email from X is real?

X only sends email from @x.com or @e.x.com, never attaches files, and never asks for your password. Even so, the safest move is to type x.com yourself rather than clicking a link.

Will deleting posts remove the hacker's access?

No. Deleting posts cleans up the mess but does not shut the door. Change your password, log out other sessions, remove app connections and turn on two-factor authentication first.

Is a hacked X account my fault?

Not necessarily. Data breaches and convincing phishing pages catch careful people too. What matters is fixing the weaknesses now.

Related Guides

Conclusion

To recover a hacked X account, change the password, secure the linked email, log out all other sessions, revoke unknown apps, turn on password reset protection and set up two-factor authentication with a saved backup code. If you are locked out, use X's account access form from the email address that was on the account, with your username and the date you last had access. Then look for the cause, warn your followers and use unique passwords everywhere. Do not trust anyone who offers to get the account back for a price.

Search This Blog

Safe Sign In