How to use a 2FA key: turning that string of letters into a 6-digit login code

A lot of buyers open their delivery, see something like "JBSWY3DPEHPK3PXP" and have no idea what to do with it. That is the 2FA secret key. You use it to generate the 6-digit code Facebook asks for at login.

What 2FA is

2FA means two-factor authentication. With it on, logging in takes your password plus a 6-digit number that changes every 30 seconds. The number is calculated from the secret key and the current time.

So the key itself is not the code. Don't paste it into the code box. You need an authenticator to turn it into 6 digits.

Option 1: an authenticator app (recommended)

Google Authenticator is the most common. Microsoft Authenticator, 2FAS and others work the same way.

1. Open the app and tap "+"
2. Choose "Enter a setup key" (not "Scan a QR code")
3. Give it any name you will recognize, like "FB - client A"
4. Paste the key and keep the type as "Time based"
5. Save. You now have a 6-digit code that refreshes every 30 seconds

When Facebook asks for the login code, type the number currently shown.

Option 2: a web tool

There are websites that generate a 2FA code if you paste the key. Convenient, but you are handing your key to that site. Fine for a throwaway test account. For anything you rely on, especially accounts with ad accounts or a BM, use an app on your phone.

The code keeps saying "incorrect"

Nine times out of ten it is one of these:

• Your phone's clock is off. Codes are time-based. A minute of drift breaks them. Set date and time to automatic
• The key was copied wrong. Extra spaces, or 0 and O, 1 and I mixed up. Keys normally contain only A-Z and 2-7
• The code expired on the way. If the timer is about to roll over, wait for the next code
• Wrong key for this account. In a bulk order every account has its own key. Copy from the right line

Should I change the key?

After the account has been stable for a few days, you can turn two-factor off in the security settings and turn it on again. That creates a new key only you know. Don't do it on the first login. Changing security settings right after a new login is a classic way to trigger a checkpoint.

Save the new key somewhere safe. If you lose your phone and don't have the key, you are locked out.

Which accounts come with 2FA

Many Facebook, Instagram, X (Twitter) and Discord listings in our store say "2FA" in the description. Deliveries usually follow a format like "login|password|2FA key|email". The exact format is written on each product.

Next step for Facebook buyers: First login on a purchased Facebook account.