Using A Security Key On X? Re-Enroll Now Or Your Account Will Be Locked

Using a Security Key on X? Re-Enroll Now or Your Account Will Be Locked

Last updated: 2025/10/26 at 5:47 PM

News Room Published 26 October 2025

Don’t miss out on our latest stories. Add PCMag as a preferred source on Google.

If you’re using a hardware security key as your two-factor authentication (2FA) method on X, you’ll need to re-enroll by Nov. 10 or your account will be locked.

“After November 10, if you haven’t re-enrolled a security key, your account will be locked until you: re-enroll; choose a different 2FA method; or elect not to use 2FA (but we always recommend you use 2FA to protect your account!),” X tweeted from its @Safety account.

If you’re affected, X will automatically prompt you to enroll. “You can re-enroll your existing security key, or enroll a new one,” it added.

The move will allow X to retire the Twitter.com domain. “To clarify: this change is not related to any security concern, and only impacts Yubikeys and passkeys—not other 2FA methods (such as authenticator apps),” it says. “Security keys enrolled as a 2FA method are currently tied to the twitter[.]com domain. Re-enrolling your security key will associate them with x[.]com, allowing us to retire the Twitter domain.”

2FA offers an extra layer of protection for your online accounts. Even if a hacker obtains your password, they’d need physical access to your devices to obtain the code provided by your security key or authenticator app.

Cybersecurity experts almost universally recommend that you use 2FA or passkeys, which X also supports. We’ve seen plenty of high-profile X accounts get hijacked over the years, including that of owner Elon Musk in 2020.

Recommended by Our Editors

To check the status of 2FA on your X account, navigate to Settings & privacy > Security and account access > Security > Two-factor authentication and choose between an authentication app or security key.

You’ll also see the option to get your code via SMS, but as of 2023, that’s only open to people with a premium X account. At the time, X justified the move by saying it was a way to get rid of bots, but it raised eyebrows by removing 2FA entirely from a person’s account if they declined to sign up for Premium and failed to switch to an authenticator app or security key by X’s deadline.