Instagram says your account is at risk: what now

In short

Why does Instagram say my account is at risk?

Instagram shows this when your password is weak or may have been exposed outside Instagram, for example in another site's data breach. Change it to a new password you don't use anywhere else and turn on two-factor authentication. If the warning came by email, check first that it's real.

What the warning means

Instagram says it asks you to change your password when it notices that the password is weak or may have been exposed or compromised by outside sources. It also says it never stores a copy of your password.

The warning doesn't mean your account has been disabled. It is a prompt to secure the account before someone else gets in.

The two most common causes

You use the same password on another website or app, and that service had a data breach
Your Instagram account is connected to a third-party app you didn't authorise

What to do right away

1Change your Instagram password to a new one you don't use anywhere else.
2Use at least eight characters and mix letters, numbers and symbols; Instagram requires at least six.
3Turn on two-factor authentication.
4Remove third-party apps and websites you don't recognise.
5Change the same password on any other account where you reused it.

Watch out for fake “at risk” messages

Scammers copy this warning to steal passwords. Instagram lists the emails it sent in the last 14 days under Recent emails in your settings; if a message isn't there, treat it as phishing. Instagram also says it never contacts you about account security through Direct Messages.

When to ask for help

If you can no longer log in to change the password, or you see posts, messages or logins you don't recognise, follow our guide to a hacked Instagram account.

Frequently asked questions

Does this warning mean my account was hacked?

Not necessarily. Instagram also shows it when your password is weak or may have been exposed elsewhere. Change the password anyway, as soon as you can.

What happens when I change my password?

Instagram says you'll be logged out of all other devices, so anyone else who was logged in to your account loses access.

How strong should my new password be?

Instagram requires at least six characters and recommends at least eight. Avoid your email, phone number or birthday, and don't reuse a password from another account.

Official sources

The platforms' own help and policy pages. We are not affiliated with them.

Instagram says your account is at risk: what it means