Reddit Account Hacked or Locked Out by Two-Factor? Get Back In and Lock It Down

Does this match what you see?

• Emails say your Reddit password or email changed, but you didn’t do it.
• Posts, comments, votes or chats you don’t recognize.
• Your two-factor code isn’t accepted, or you lost your authenticator.

Computer (browser)iPhone & iPadAndroid

Based on Reddit Help articles on hacked accounts and two-factor authentication, supplied by the site owner on November 9, 2026. Two-factor settings are only available in a web browser on a computer.

Why this happens: the possible causes

Reddit lists these as common ways accounts get taken over.

• A password reused from another siteCheck this first

  Reddit lists reusing usernames and passwords across sites as a common cause.

• Authenticator app or phone clock out of syncPossible

  Reddit suggests checking your system time and time zone when 2FA codes fail.

Signs your account was hacked

• Emails saying your password or email changed when you didn’t change them.
• Authorized apps on your account you don’t recognize.
• Unusual IP history on your account activity page (reddit.com/account-activity).
• Votes, posts, comments or chat messages you don’t remember making.

Just got a red warning asking you to reset your password? That’s a security lock, not necessarily a hack: see Reddit account locked.

How to fix it, step by step

Work through these in order. They start with the quickest, safest checks and only move to steps that sign you out or remove data later.

Get your backup codes (do this now)

Reddit says two-factor can only be managed in a web browser on a computer. While logged in:

1. Click your username (top right) > Settings.
2. Under Account authorization, click Access your backup codes.
3. Enter your password and click Continue. You get 10 codes, each usable once.

On old Reddit: preferences > password/email tab > generate next to backup codes. Generating new codes cancels the old ones, and you can only do it while logged in, so save them in a safe place or a password manager.

Two-factor in third-party Reddit apps

Reddit says two-factor works with any app that signs in through OAuth (Reddit’s standard sign-in method): you’ll be asked for your 6-digit code as usual.

Some third-party apps don’t use OAuth and may not let you in. For those, Reddit says:

1. Enter your Reddit username as normal.
2. In the password field, type your password, a colon, then your 6-digit code, with no spaces, for example yourpassword:123456. Without the colon it won’t work.

Our note: only type your Reddit password into apps you trust. Reddit lists giving unsafe apps access to your account as a common way accounts get taken over.

Turn off two-factor

Also only in a computer’s web browser: Settings > Account authorization > Two-factor authentication, enter your password, and click Turn Off. On old Reddit: preferences > password/email > click to disable, then Disable Two-factor. Our note: turning it off makes your account easier to take over; consider saving new backup codes instead.

Lock your account down

• Use a strong, unique password and a password manager.
• Turn on two-factor and save your backup codes.
• Keep a current, verified email on your account, so you get security notices and can reset your password.
• Don’t share your account, and don’t stay logged in or save passwords on shared devices.
• Use the account activity page to log out of all sessions.
• Our tip: remove authorized apps you don’t recognize.

How to know it worked

• You’re in control of the account, with a new password, a verified email and two-factor on.

Still not working? Your next steps

1. Forgot your password or username, or no email on the account? See can’t log in to Reddit.

Frequently asked questions