Hacked X account? Reset your password, log out unknown sessions, turn on two-factor authentication and use X's own form if you are locked out.

Quick answer: If you can still log in to X, change your password at x.com/settings/password, remove apps you do not recognise, and log out other sessions. If you are locked out, use Forgot password? on the X sign-in page (x.com/account/begin_password_reset). If you still cannot get in, X's "Account is hacked or compromised" support form in its Help Center is the official route. Recovery runs through X's own pages, so do not pay anyone to do it for you.

60 minutesHow long an X password reset code stays valid, per X's password help page

3 methodsX two-factor authentication: text message, authentication app or security key

About 1 hourHow long X says a temporary lock after too many failed log-ins lasts

A hacked X account is often used to post spam or send scam links to your followers in your name. X publishes a short list of steps for a compromised account. This guide puts them in order.

What to do in 3 steps

Change your password now. If you can log in, go to x.com/settings/password. If you are logged out, use Forgot password? on the sign-in page. Choose a strong password you have not used anywhere else.
Secure the email address on your account. If the attacker can read that inbox, they can keep resetting X. Make sure only you have access to it.
Remove apps and sessions you do not recognise. Open Apps and sessions (x.com/settings/applications), revoke apps you do not know, and use Log out all other sessions.

A. You can still log in: secure the account

X says signs of a compromise include posts you did not write, Direct Messages you did not send, follows or blocks you did not make, a notice from X that your account may be compromised or that your account information changed when you did not change it, or a password that suddenly stops working.

Change your password. X points to the Password tab in settings (x.com/settings/password). In the X app on iPhone or Android, X's help page words the path as Settings and privacy > Your account > Change your password. On a computer, click More in the navigation bar, choose Settings and privacy, then under Your account click Change your password. X says changing your password logs you out of every other active session except the one you are using.
Check your email address under Account settings (x.com/settings/account). X sends a "Confirm now" email when you change it.
Revoke third-party apps you do not recognise in Apps and sessions. X explains that a connected app can, depending on its permissions, read your posts, post for you or read your Direct Messages.
Log out other sessions. On the same page, under Sessions, you can see the location and time of each login. Click Log out next to one, or Log out all other sessions. X notes this may not remove data already saved on that device.
Update your password in apps you trust. X warns that an app still using your old password can cause a temporary lock-out from failed log-ins.

Turn on two-factor authentication

Two-factor authentication is an extra check on top of your password. X offers three methods: Text message, Authentication app or Security key. In the X app on iPhone or Android, X's page words the path as Settings and privacy > Security and account access > Security > Two-factor authentication (on Android, open Settings and privacy from the navigation menu icon or your profile icon). On a computer, click More in the side menu, then follow the same path. X shows a backup code at setup and recommends you keep a copy, because it helps if you lose your phone or change your number. X's two-factor help page says that if you are logged out and do not have an active backup code, you should contact its support team.

B. You are locked out but still have your email or phone

X says you need access to the phone number or email linked to the account to reset the password.

On the sign-in page of x.com or the X app, choose Forgot password?
Enter your email address, phone number or X username. (If several accounts share your phone number, X says you cannot use the number at this step.)
Choose where to receive the reset message. X sends a code valid for 60 minutes.
Enter the code, then choose a new password.

If you added a phone number, X may offer a reset by text message instead. If codes do not arrive, X's password page has a troubleshooting section; read it before retrying, because repeated failed attempts can lock you out (see section D).

C. The attacker changed your email, phone or password

Check your old email inbox. X says that whenever an account's email is changed, it sends a notice to the previously used address. X also says that if it believes an account was hacked, it may reset the password itself and email the real owner a reset link on x.com.
Try the normal reset first (section B), in case your original email or phone still works.
Submit X's compromised-account form. X says that if you still cannot log in after a password reset, submit a support request through the "Account is hacked or compromised" form (help.x.com/en/forms/account-access/regain-access/hacked-or-compromised). Use the email address you linked to the compromised account, because X sends further instructions there, and include your username and the date you last had access. The form says that if no email address is linked to the account, X will need to verify your phone number by text message, and X's email-access page says that if that number was previously linked to the account, X will review the request and may re-add the number so you can get back in.

X has a separate page for people who lost access to their account's email. It says that with no access to the account's email or a verified mobile number, X is unable to continue troubleshooting; it explains that these checks stop it giving account information to the wrong person. X's password page adds that in this situation you may need to sign up for a new account. If the attacker got in through your email, secure that first. Our guide to recovering a hacked Gmail account may help if you use Gmail.

D. The account is locked, limited or suspended

Temporary lock. X says that after too many failed log-ins you are blocked for about an hour, and the lock clears by itself. If it does not, X suggests turning off third-party apps that may be retrying an old password, waiting an hour, then trying x.com/login again.

"Your account has been locked." X says this can mean it saw suspicious activity and the account may be compromised. If you can still log in, follow the on-screen instructions, which include changing your password. X may ask you to confirm you own the account by phone, email or a captcha check. If you cannot log in at all, the page points you to its support team.

Suspended. X says it may suspend an account it suspects was hacked until it can be secured and returned to its owner. If you think a suspension or lock was a mistake, log in to the account, open a new browser tab and file an appeal (help.x.com/en/forms/account-access/appeals). The pages we read do not say how long a review takes.

E. After you are back in

Delete posts published while the account was compromised, and check Direct Messages, follows and blocks.
Scan your computer for viruses and malware and install security updates. X recommends this especially if odd activity continues after a password change.
Turn on Password reset protection in your Account settings (x.com/settings/account). X says that with it on, anyone asking for a reset link or code must first enter your account's email address or phone number.
Use a different password on every site, including your email. If you reused the old X password elsewhere, change it there too. A password manager can help.
Warn your followers that any link or request sent in your name is not from you.

X also notes that unexpected posts do not always mean a hack: a third-party app can have a bug. Changing your password and revoking apps stops that too.

Warning: fake recovery services and fake support

Be wary of anyone who offers to get your account back, or asks for money, your password or a login code. X's account security page says X will never ask for your password by email, Direct Message or reply, and will never ask you to download something or sign in to a site that is not X. Its fake-email page adds that X does not send emails with attachments. X also says its genuine emails now show a blue checkmark next to the sender in most major email apps, and not to engage with emails that lack it. Do not pay anyone and do not give anyone your password.

F. If you are being threatened or blackmailed

If the person who took your account threatens to share private photos or messages unless you pay, do not pay. Read our guide to sextortion and online blackmail and report it to the police.

G. A child's or teenager's account

If the account belongs to a young person, ask a parent or trusted adult to follow these steps with them, and never deal with anyone who offers to "fix" the account.

What X does not promise

X's form says a member of its team will be in touch "as soon as possible", but the pages we read give no support phone line, no guaranteed outcome and no timeline for a reply or an appeal. If you cannot show access through the account's email or phone, X says it may be unable to help further.

We checked the steps against X's own help pages on 26 October 2026; menus change, so follow the on-screen prompts if they differ.

Sources

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.

Hacked X (Twitter) Account: How to Recover It (2026)