An X account carries more risk than its casual feel suggests. Verified-looking handles get hijacked to push crypto scams, DMs become phishing bait aimed at your followers, and years of authorized third-party apps - Remember all those "sign in with Twitter" tools? - Quietly retain access tokens. The platform's rename from Twitter also spawned a wave of convincing phishing mail ("confirm your account for X"), which harvested plenty of real passwords. If yours is weak, reused, potentially phished, or simply old enough to predate the rename, changing it is quick. The settings live in roughly the same place they always did, just under new branding.
Change Your X Password on the Web
On a desktop browser:
- Log in at x.com and click More (the ••• icon in the left sidebar).
- Choose Settings and privacy.
- Select Your account → Change your password.
- Enter your current password, then the new password twice.
- Save. X then offers the option to log out of other sessions - Take it if there's any doubt about who else might be signed in.
X asks for a minimum of 8 characters, but that's a floor from another era. A 16+ character random string from a password generator is the sensible default, and if you're curious how much the extra length buys you, the password strength checker will show the difference in estimated crack time between 8 and 16 characters - It's not double, it's astronomical.
Change It in the Mobile App
The app follows the same tree:
- Tap your profile picture (top-left) to open the side menu.
- Tap Settings and privacy (listed under "Settings and Support" on current versions).
- Tap Your account → Change your password.
- Enter the current password, then the new one twice, and confirm.
The steps are the same on iPhone and Android. If you log in through Google or Apple sign-in and have never set a password, use the account settings to add one - It's required for some security features and gives you a fallback login route.
If You've Forgotten Your Password
From the login screen, tap Forgot password?:
- Enter your email address, phone number, or username to locate the account.
- Choose where to receive the verification code - The email or phone number on file.
- Enter the code, then set and confirm the new password.
If you no longer control the email or phone attached to the account, the reset screen's help link leads to X's support form for account access; expect to verify ownership with details like the account's email history. One caution born from the rename chaos: only ever perform resets at x.com (twitter.com still redirects there). Emails urging you to "verify your account or lose your handle" are a staple of social engineering - The pressure and deadline are the tell, and typing your password into the linked page is exactly what the sender wants.
Rebrands are phishing season. Any email that says "your account settings changed, log in here to review" deserves a manually typed URL, never a click.
After You Change It
| Follow-up | Where on X | Why |
|---|---|---|
| Log out other sessions | Settings → Security and account access → Apps and sessions → Sessions | Kills any login the old password created |
| Enable two-factor authentication | Settings → Security and account access → Security | Password alone no longer opens the account |
| Revoke stale connected apps | Apps and sessions → Connected apps | Years-old tools keep access until revoked |
| Confirm email and phone | Settings → Your account → Account information | Stops resets going to stale or hostile contacts |
| Update your password manager | Your vault | The new credential becomes the single source of truth |
Two of these deserve detail. First, two-factor authentication: X restricts SMS-based 2FA to paying subscribers, but that's no loss - Authenticator-app codes are stronger anyway, immune to SIM-swapping, and free. The trade-offs are covered in TOTP vs SMS 2FA, and our TOTP generator shows how the six-digit codes are computed from a shared secret. X also supports hardware security keys, the strongest option available; see hardware security keys explained if you want phishing-proof login.
Second, connected apps: a decade of Twitter's open API era means many long-time accounts have dozens of authorized third-party tools, some dead, some sold to new owners. Each retains whatever access you granted, independent of your password. Revoke everything you don't actively use.
Finally - The reason this article exists for so many readers - If the old password was reused on other sites, change it there too. Automated tools will try any leaked X credential against email providers, banks, and shops within days, and if you've been putting off a broader cleanup, the 15-minute password hygiene checklist turns it into a single bounded project.
FAQ
Does changing my X password log out other devices?
Only if you choose to. After a password change, X offers a checkbox-style option to log out of other sessions, and you can always do it manually under Apps and sessions → Sessions. If the change was prompted by suspicious activity, sweeping sessions isn't optional - An attacker's existing session can survive the new password.
Can I still use SMS two-factor authentication on X?
Only with a premium subscription - X limited SMS 2FA to subscribers in 2023. Everyone else can use an authenticator app or a hardware security key, both of which are more resistant to interception than text messages, so most users lose nothing.
My old Twitter password stopped working after the rebrand - Why?
The rename to X didn't change anyone's password; credentials carried over unchanged. If yours fails, the likely explanations are a typo'd or forgotten password, or that the account was compromised and its password changed. Run the reset flow, and once you're back in, sweep sessions and check that your email and phone number are still yours.
How long should an X password be?
Sixteen random characters or more, unique to X. The 8-character minimum can be brute-forced cheaply with modern GPUs, and any password shared with another site inherits that site's next breach. Generate it randomly, store it in a manager, and let 2FA carry the rest.