Your friends are messaging you about the strange DMs they got from your account. There is a login alert from a city you have never visited, your password suddenly stops working, or you opened an email saying the address on your account was just changed. That sinking feeling is real, but so is the good news. Instagram has dedicated recovery paths for exactly this situation, and most people who act quickly get their account back. The trick is knowing the right steps in the right order, and doing them safely.
For the reset itself, a browser based strong password generator builds a long random password in one click. It runs entirely on your device, so the new password is never transmitted anywhere.
Before you touch anything, two ground rules will protect you the whole way through. Start your recovery on a device, browser, and network you have used to sign in to Instagram before, because a familiar device makes it far easier for Instagram to recognize you. And never share a verification code, your password, or a two-factor code with anyone, no matter how official they sound. Real Instagram support will never ask you for them.
Confirm the Compromise Before You React
Take a breath and check whether you have actually been hacked or just locked out by a glitch. The clearest signs are posts, stories, or DMs you did not create, a changed profile photo or bio, an email from Instagram about a password or email change you did not request, or a login notification from an unfamiliar device or location.
If you still have access to the app right now, do not log out to "test" anything. Keeping your active session is an advantage, and the next step uses it to slam the door on the attacker. If you are already locked out, skip ahead to the recovery flows below.
One more safety note before you start. Do not create a brand-new Instagram account to report the hacked one. Reporting works through Instagram's own recovery tools tied to your real account, and a fresh account only confuses the process.
Change Your Password and Log Out Other Sessions
If you can still log in, changing your password is the single fastest way to lock out whoever got in. A strong, unique password that you do not reuse anywhere else immediately invalidates the access the attacker was relying on.
- 1.Open your settings and go to the Meta Accounts Center, then Password and security.
- 2.Choose to change your password, or send yourself a password reset email.
- 3.You can also go directly to the change page at accountscenter.instagram.com/password_and_security/password/change/.
- 4.Enter a new password you have never used before and save it.
Changing the password is also what forces other sessions off, because the attacker's logged-in session can no longer authenticate. After this, jump to the section on reviewing login activity so you can confirm no unrecognized device is still connected.
Locked Out and Need a Login Link or Password Reset
If your password no longer works and you cannot get into the app, the login screen itself is your recovery starting point. Instagram can send a recovery link to the email or phone number on your account.
- 1.On the login screen, tap Get help logging in on Android, or Forgot password on iPhone.
- 2.Enter your username, email, or phone number, then tap Send Login Link.
- 3.If your Instagram and Facebook accounts are linked, you can also choose Reset using Facebook.
- 4.When the email arrives, choose to reset your password rather than simply logging in, so the attacker's access is cut off too.
Because you are about to enter credentials, make sure you are on the genuine official domain before you type anything. Confirm the page is on instagram.com or accountscenter.instagram.com, and ignore any link in a text or DM that pushes you to a lookalike site.
Run the Official instagram.com/hacked Recovery Flow
When the basic reset is not enough, Instagram's dedicated entry point for account-access problems is instagram.com/hacked. This is a self-service flow built specifically for compromised and inaccessible accounts.
Go to instagram.com/hacked and select the option that matches your situation, such as your account being hacked, not being able to log in, or someone impersonating you. The flow then routes you to the correct recovery path for your case, so you are not guessing which form to use.
Treat this page as the official hub for everything that follows. If a step asks you to verify your identity, you are in the right place, but it will only ever happen inside Instagram's own flow, never through a stranger offering to "help" you for a fee.
If the Hacker Changed Your Email, Revert It Fast
Attackers often try to change the email address on your account so they can lock you out of resets. When that happens, Instagram sends a notification email to your original address letting you undo it.
Open the email from Instagram that says your email address was changed, and look for the revert this change option inside that message. Selecting it can restore your original email and block the takeover. Act quickly, because this link can expire, and the sooner you use it the better your odds of catching the change before more damage is done.
When Two-Factor Authentication Is Blocking You
If you had two-factor authentication turned on but have lost access to your phone or email and cannot receive a login code, you are not stuck. The saved backup codes you were given when you set up two-factor are designed for exactly this moment.
Enter one of your saved backup codes to log in. Keep in mind each backup code works only once, so cross it off after use. If you never saved your backup codes and you no longer have your second-factor device, do not panic. You will fall back to the Get help logging in flow and the identity-verification path described below.
Lost the Email or Phone on the Account and Need Support
Sometimes the attacker swaps out both the email and the phone number, leaving you with nothing on the account to receive a code. Instagram has a recovery path for precisely this.
Follow the lost-email-or-phone recovery path from the help-logging-in flow. You may be asked to verify your identity by providing details such as a phone number, security information, or other proof of access connected to the account. Provide what you genuinely have, because this is how Instagram rebuilds confidence that the account is yours, not the hacker's.
Confirm Your Identity With a Video Selfie
If Instagram cannot verify you any other way, it may ask you to upload a short video selfie while you are having trouble logging in. This step exists because it is hard for an impersonator to fake, which makes it one of the strongest ways to prove you are the real owner.
The video is used only to confirm you are a real person, and it is not posted to your profile. Complete it directly inside Instagram's own flow on the official domain. No legitimate process will ever route your video selfie or ID upload through a third-party site or a private message.
Review and Revoke Suspicious Logins
Once you are back in, do not assume the danger has passed. The attacker may have lingering sessions, so your next move is to audit everything that has touched the account.
- 1.Open your login activity to see the devices and locations that have recently accessed your account.
- 2.Look carefully for any device, browser, or location you do not recognize.
- 3.Log out of every session you do not recognize, which forces the attacker off your account.
- 4.If you have not already done so this session, change your password again now that everything else is clean.
This is also a good moment to skim your profile, bio, linked email, and phone number to make sure the attacker did not leave changes behind that could let them back in later.
Lock the Account Down With Two-Factor Authentication
Recovering the account is only half the job. The other half is making sure the same break-in cannot happen again. After regaining access, Instagram advises turning two-factor authentication on, or back on, so a login code is required in addition to your password.
Instagram supports two-factor through an SMS text message, a third-party authentication app such as Duo Mobile or Google Authenticator, and WhatsApp. The text-message method has to be enabled first before you can use the WhatsApp option. An authentication app is generally the sturdier choice because it does not depend on your phone number, which can itself be hijacked.
When you set up two-factor, save your backup codes somewhere safe and offline. Those codes are your lifeline if you ever lose your phone again, and they let you log straight back in instead of starting recovery from scratch. A final reminder as you finish. Skip any paid third-party "account recovery service," because everything you need is free through Instagram's official tools, and handing your credentials to an outsider only creates a new risk.
Frequently Asked Questions
How long does Instagram take to recover a hacked account?
Instagram does not publish a fixed timeline for account recovery. After you submit a request through instagram.com/hacked or the help-logging-in flow, watch for a follow-up email from Instagram with your next steps, and respond promptly to keep things moving.
What if I never saved my two-factor backup codes?
If you no longer have your backup codes and you have lost your second-factor device, you can still recover access through the Get help logging in flow and, if asked, the video-selfie identity-verification path. Going forward, save a fresh set of backup codes the moment you re-enable two-factor.
Should I make a new account to report the hack?
No. Do not create a brand-new account to report a hacked one. Reporting and recovery happen through Instagram's own tools tied to your real account, primarily instagram.com/hacked and the in-app help-logging-in flow.
Will Instagram ever ask me for my password or login code?
No. Real Instagram support will never ask you to share your password, a verification code, or a two-factor code. Anyone who does is trying to steal your account, so never hand those over to a person, a DM, or an outside website.
Are paid account-recovery services worth it?
No. Every legitimate recovery step is available for free through Instagram's official flows. A paid third-party "recovery service" cannot do anything you cannot do yourself and often just collects your credentials, so avoid them entirely.
How do I make sure I am on the real Instagram page?
Before entering credentials or uploading any ID, confirm the address is on instagram.com or accountscenter.instagram.com, and start from a device, browser, and network you have used to sign in before. Ignore links from texts or DMs that send you to lookalike sites.
