How to Reset Your Facebook Password (and Lock Out Intruders)

You can reset a Facebook password in about five minutes using the email or phone number tied to the account, and locking out intruders takes one extra click on the security page. The steps for how to reset your facebook password (and lock out intruders) start at facebook.com/login/identify, where you enter your contact info and follow the code sent to you. Your exact path changes based on three things. It matters whether you still have access to your old email, if someone else is currently logged into your account, and which two-factor method you set up before this happened.

Who needs a Facebook password reset

Someone locked out after forgetting their login details just needs the standard recovery link. They still control their email inbox and haven’t seen any strange posts on their timeline. This page gives them the basic steps to get back in without losing anything. A second reader noticed unfamiliar messages sent from their profile or friends reporting weird links. They suspect someone else already has their login details. They need the recovery steps plus the part about ending active sessions so the other person gets kicked out immediately. A third type lost access to both the account and the email address attached to it. They can’t receive the six-digit code that starts the process. They shouldn’t use the standard steps here because they won’t work. Instead, they must use Meta’s identity verification flow, which asks for a government ID. This page serves the first two readers best. It assumes you can still open the email inbox or read the text messages sent to the phone number listed on your Facebook settings page.

What changes your recovery options

The contact method you pick decides how fast you get back in. If you choose an email you check daily, the six-digit code arrives within 60 seconds. Pick an old phone number you no longer own, and you’ll hit a dead end immediately. Check your current devices to see which email or number you can actually open right now. Two-factor authentication adds a mandatory second step after you type the new password. With an authenticator app like Google Authenticator, you’ll read a rotating six-digit code off your phone screen. If you rely only on SMS texts, you’re stuck waiting for a carrier message that sometimes takes several minutes. You can see your active method under Settings > Security and Login. Active sessions determine whether changing the password actually removes the intruder. Someone logged in on another device might stay connected even after you change the credentials, depending on when their session started. You must manually review the “Where you’re logged in” list to force them out. Look for locations or device names you don’t recognize. The thing people get wrong most often is assuming a password change automatically ends every other session. It doesn’t always happen instantly if you skip the checkbox asking to log out of other devices during the reset flow. Always verify the session list yourself after finishing the steps. Your account status also shifts the timeline. A temporarily locked account requires extra identity checks that add hours to the wait, while a normal forgotten password takes just a few minutes. Read the red banner on your screen to know which state you’re in.

Steps to recover your Facebook account

Follow these actions in order on a phone or computer browser. Don’t use a public Wi-Fi network while doing this, as unsecured connections expose the codes sent to you.

1. Go to facebook.com/login/identify on your browser. Type the email address or phone number currently linked to your account in the search box.
2. Select how you want to receive the six-digit security code. Choose between an SMS text message or an email, then tap Continue.
3. Open your text messages or email inbox to find the code from Facebook. Type those six digits into the recovery box on your screen within 10 minutes.
4. Create a new password with at least 12 characters. Mix uppercase letters, lowercase letters, numbers, and symbols, avoiding any word you’ve used on another website.
5. Check the box labeled “Log out of other devices” when the screen offers it. This forces anyone else using your account to lose access immediately.
6. Click through to your main profile and go to Settings & Privacy > Settings > Security and Login. Review the “Where you’re logged in” section to confirm no unknown phones or computers remain.
7. Turn on two-factor authentication if it isn’t active yet. Select “Authentication App” as your preferred method and scan the QR code with an app like Authy or Microsoft Authenticator.

The single judgment call that separates a secure account from a vulnerable one happens at step six. Simply changing the password doesn’t guarantee the intruder is gone if you skip reviewing the active session list. An unrecognized device sitting in that list means someone still has access, regardless of your new password. If you see a location or device you don’t own, tap the three dots next to it and select Log Out. If your account was disabled by Meta rather than just locked due to a forgotten password, these steps won’t work. You’ll need to submit an appeal through Meta’s account recovery form, which requires uploading a government-issued ID. That process involves manual review by their support team, not an automated code.

Situations that change the process

Different starting points require different actions during recovery. Here is what to do based on your specific situation.

Your situation	Action to take	Time required	Watch out for
Have email access	Use standard recovery link	Under 5 minutes	Code expires in 10 minutes
Lost email access	Try trusted contacts or ID upload	Several hours to days	Requires government photo ID
Suspect active intruder	Change password, end all sessions	About 10 minutes	Missed hidden active devices
Two-factor enabled	Enter app code after password	Under 5 minutes	Lost backup recovery codes
Account temporarily locked	Follow on-screen identity prompts	Up to 48 hours	Repeated failed attempts extend lock
Hacked email too	Secure email provider first	Varies widely	Intruder resets your new password

If your email was compromised alongside Facebook, you must fix the email account first. Otherwise, the intruder will just use your email to reset the Facebook password again right after you change it.

Details to reset your Facebook password and lock intruders out

Ending active sessions correctly

Changing your password is only half the job. You have to manually terminate existing connections to kick someone out. Go to Settings & Privacy, then Settings, and find Security and Login. Look at the list under “Where you’re logged in.” Tap the three vertical dots next to any device or city you don’t recognize. Select Log Out to sever that connection immediately. Don’t just click “Log out of all sessions” blindly if you share an account with a family member for a business page. Doing that locks out legitimate admins too. Identify the specific suspicious entry and remove only that one.

Choosing a password that holds up

A 12-character password takes significantly longer to crack than an eight-character one. Use a phrase made of four random words separated by symbols, like Blue#Coffee$Train!99. Never reuse a password from your email, bank, or shopping accounts. If one site suffers a data breach, attackers try those same credentials everywhere else automatically. Skip the security questions if Facebook still offers them on older accounts. Answers like your mother’s maiden name are often visible on public genealogy sites or social media profiles. Rely entirely on two-factor authentication instead.

Fixing common Facebook login problems

When the standard process fails, specific symptoms point to specific causes. Match what you see on your screen to the correct fix below.

What you notice	What it usually means	What to do first	How to stop it happening again
Code never arrives	Carrier delay or blocked sender	Wait 5 minutes, request new code	Add Facebook to safe senders list
“Account disabled” message	Violation of community standards detected	Submit appeal with ID through Help Center	Review Meta’s Community Standards rules
Password rejected instantly	Typing error or caps lock left on	Retype slowly, check keyboard layout	Use a password manager to autofill
Two-factor prompt loops	App time sync is incorrect	Resync clock in authenticator app settings	Save printed backup codes safely offline
Recovery link expired	Ten-minute window passed before clicking	Request a fresh link from login page	Keep email tab open while requesting code
Unknown device stays listed	Session token didn’t clear properly	Force logout, clear browser cache	Review active sessions weekly

If you can’t receive SMS codes because you changed phone carriers, you’ll need to use the backup codes you were given when setting up two-factor authentication. Without those, you must proceed through the identity verification route.

Rules governing account recovery

Meta controls the recovery process under its Terms of Service, which require you to provide accurate information and not share your login credentials. When automated systems fail, they may ask for a government-issued ID to prove you own the profile. In the European Union, the Digital Services Act requires platforms like Facebook to offer clear, accessible complaint mechanisms when users lose access to their accounts. You can find your region’s specific rights on the European Commission’s digital policy pages. In the US, there’s no federal law mandating a specific recovery timeframe for social media accounts. Meta’s own policies dictate the wait times, which you can read in their Help Center documentation. If you suspect identity theft beyond just Facebook—like someone opening credit lines in your name—report it to the Federal Trade Commission at IdentityTheft.gov. A social media company can’t investigate broader financial fraud for you. Recovery involving legal disputes over page ownership, especially for business assets, stops being a self-service task. You’ll need to consult a lawyer familiar with digital property rights in your jurisdiction.

Time and effort required

The actual cost here isn’t money; it’s time and attention. If you have your phone and email working, the whole process takes about five minutes of active typing and waiting for a text message. If you’ve lost access to your primary email, the timeline stretches significantly. Verifying your identity through Meta’s document upload system typically takes anywhere from 48 hours to several days, depending on their current review queue volume. The hidden cost is the risk of permanent data loss. If an intruder deletes your account before you recover it, Meta states that deleted content can’t be restored after 30 days. You lose photos, messages, and connections permanently. To reduce the time spent next time, save your two-factor backup codes in a physical notebook or a dedicated password manager like Bitwarden or 1Password. Searching for those codes during a panic adds unnecessary minutes to the process. Check your recovery settings today rather than waiting for an emergency. Knowing exactly which phone number receives the code prevents wasted time guessing during a stressful lockout.

Keeping your account secure afterward

Once you’re back in, the work isn’t finished. You need to set up alerts so you know immediately if someone tries to log in again. Go to Security and Login settings and turn on “Get alerts about unrecognized logins.” Facebook will notify you via Messenger or email whenever a new device accesses your profile. Don’t ignore these notifications. If you didn’t trigger the alert, change your password again right away. Review your authorized apps under Settings > Apps and Websites. Remove any game or quiz you haven’t used in the past six months, as old connections serve as backdoors if those third-party services get breached. There’s no fixed schedule published by Meta for changing passwords unless you suspect a compromise. Instead of rotating passwords monthly, monitor your active session list weekly. If the list shows only your known devices, your current password is still doing its job.

When these steps won’t work

If your account was permanently deleted by the intruder more than 30 days ago, these recovery steps won’t restore it. You’ll have to create a brand-new profile and rebuild your friend list from scratch. If the hacker changed the email and phone number, and you don’t have two-factor authentication or trusted contacts set up, the automated system will reject you. You must use Meta’s compromised account reporting tool and upload a photo of your driver’s license or passport. For business pages tied to a Business Manager account where the admin was removed, standard personal password recovery won’t give you page control back. Another remaining admin must re-add you, or you’ll need to contact Meta Business Support directly through your ad account dashboard. If you’re dealing with targeted harassment or extortion alongside the hack, recovering the account yourself isn’t enough. Contact local law enforcement and file a report with the FBI’s Internet Crime Complaint Center (IC3) before taking further action on the platform.

Frequently asked questions

How long does a Facebook password reset take?

It takes under five minutes if you have immediate access to your registered email or phone number. If you must verify your identity with a government ID upload, expect to wait between 48 hours and several days for Meta’s team to review your documents.

Can I reset my Facebook password without my old email?

Yes, but only if you previously added a mobile phone number or set up trusted contacts. Without any accessible recovery method, you can’t use the automated tool and must submit an identity verification request through Meta’s help forms.

Why did Facebook lock my account during a reset?

Multiple failed attempts to enter the security code trigger an automatic temporary lock to prevent brute-force attacks. Wait 24 hours without attempting to log in, then try the recovery link again from a device and IP address you normally use.

Is it safe to use the Facebook password reset link?

Yes, provided you navigated to facebook.com yourself or clicked a link from an official @facebookmail.com email address. Never enter your details on a page you reached through a direct message or a third-party website claiming to help you recover access.

What happens if an intruder changed my email address?

Facebook sends a notification to your original email address when the contact info is modified. That email contains a special link allowing you to reverse the change. If you missed that window, you must verify your identity using a government-issued photo ID.

Does changing my password log everyone else out?

Not automatically. You must check the box offering to “Log out of other devices” during the reset process. Even then, manually review your active sessions in the Security and Login settings to ensure no unrecognized connections survived the update.

How many characters should my new Facebook password have?

Use at least 12 characters. A shorter password is mathematically easier for automated tools to guess. Combine uppercase letters, lowercase letters, numbers, and symbols, ensuring the phrase doesn’t contain your name, birth year, or common dictionary words.

Do I need a lawyer if my Facebook account was hacked?

No, not for a standard personal account takeover. Use Meta’s built-in recovery tools first. However, if the hack resulted in financial fraud, stolen business assets, or extortion, file a police report and consult an attorney specializing in cybercrime or digital assets.

Start securing your Facebook account now

Open facebook.com/login/identify on your browser and enter your current email or phone number to begin the recovery process. You’ll know it worked when you land on your news feed and the active sessions list shows only your own devices. Stop and submit a government ID through Meta’s official help forms if the automated system rejects your contact info twice.