> ## Content Index > Fetch the complete content index at: https://www.skimwire.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to turn on two-factor authentication in ChatGPT and lock down your account - URL: https://www.skimwire.com/how-to-turn-on-two-factor-authentication-chatgpt/ - Published: 2026-11-01T13:41:32.000Z - Updated: 2026-11-01T13:41:32.000Z - Description: Turn on MFA under Settings > Security and login, add a passkey, check security history, log out other devices and clean up shared links. - Author: Skimwire Staff - Tags: How-To, Security **Quick answer:** In ChatGPT, open **Settings > Security and login**, choose a method under **Multi-factor authentication (MFA)** and follow the prompts. While you're there, check **Security history** and use **Log out of all sessions** if anything looks unfamiliar. This week a security firm showed how a single booby-trapped ChatGPT share link could take over a signed-in account ([here's our story on the ChatGPT share-link flaw](https://www.skimwire.com/chatgpt-shared-link-flaw-account-takeover-fixed/)). OpenAI fixed that bug, and you don't need to do anything about it. But it's a good reminder that your ChatGPT history can hold a lot of personal and work information. These steps take about five minutes and come from OpenAI's own help pages. ## Before you start - These settings live in your OpenAI account, so they apply on the web and in the ChatGPT apps. OpenAI says MFA covers both ChatGPT and the API Platform. - OpenAI says the MFA options you see can vary by device, country, account tier and how your account was created. - Have your phone handy if you plan to use an authenticator app or text codes. ## Step 1: Turn on multi-factor authentication 1. Sign in to ChatGPT and open **Settings**. 2. Go to **Security and login**. 3. Under **Multi-factor authentication (MFA)**, pick a method and follow the on-screen prompts. OpenAI lists an authenticator app, push notifications, text message (SMS or WhatsApp in supported regions) and passkeys. 4. Consider adding a second method as a backup. When several are on, OpenAI asks for the most secure one first, but you can pick any of them at sign-in. An authenticator app or passkey is the strongest everyday choice. Text codes are better than nothing but can be intercepted or redirected through SIM-swap scams. ## Step 2: Add a passkey (optional) 1. Sign in to ChatGPT on the web and open **Settings > Security**. 2. Under **Passkeys**, select **Add passkey** and follow the on-screen instructions. OpenAI says the option may not appear yet for every account, depending on how it was created and how you sign in. Passkeys can't be phished the way passwords can. If you're new to them, our guide on [setting up passkeys on iPhone, Android and Windows](https://www.skimwire.com/how-to-set-up-passkeys-iphone-android-windows/) explains how they work. ## Step 3: Check your security history 1. Go to **Settings > Security and login**. 2. Open **Security history** and look for sign-ins or changes you don't recognize. ## Step 4: Log out of devices you don't recognize 1. Go to **Settings > Security and login**. 2. Select **Log out of all devices** (some versions show it under **Active sessions** as **Log out of all sessions**) and confirm. OpenAI says this can take up to 30 minutes to reach every device. Turning on MFA by itself doesn't sign out other sessions, so do this step if you're at all unsure. If something looked suspicious, change your password too. ## Step 5: Clean up old shared links 1. Go to **Settings > Data controls**. 2. Next to **Shared links**, choose **Manage**. 3. Select **Delete shared link** on any link you no longer need, or open **More actions** and select **Delete all shared links**. OpenAI says shared links have no expiration date, and anyone who has a link from a personal account can view it. Deleting a link doesn't delete the original chat. Real ChatGPT share links start with https://chatgpt.com/share/. Only open ones from people you trust. ## Troubleshooting - **I don't see Security and login.** Try chatgpt.com in a browser. OpenAI's passkey help page labels the section simply **Security**. - **I lost my MFA device.** Pick another method you set up when prompted. If you have none, contact OpenAI Support. Verification can take a few days, and Support then gives you a one-time email recovery login that only works once. - **My boss wants MFA for the whole team.** OpenAI says MFA can't currently be enforced at the workspace level, so each person has to turn it on. ## FAQ **Does turning on MFA log me out everywhere?** No. OpenAI says existing sessions stay signed in, so use **Log out of all devices** separately. **Do I need to do anything about the share-link bug?** No. OpenAI fixed it on its servers on Oct. 26, and the researchers didn't report any real-world use. **Can people see my private chats through a shared link?** A shared link shows the conversation you shared, not your other chats. The bug that broke that boundary has been fixed. *Sources: OpenAI Help Center articles on* [*managing MFA*](https://help.openai.com/en/articles/7967234-managing-multi-factor-authentication-mfa?ref=skimwire.com)*,* [*keeping your account secure*](https://help.openai.com/en/articles/8304786-keeping-your-openai-account-secure?ref=skimwire.com)*,* [*passkeys*](https://help.openai.com/en/articles/20001039-passkeys-to-secure-your-openai-account?ref=skimwire.com) *and* [*sharing conversations*](https://help.openai.com/en/articles/7925741-sharing-conversations-and-scheduled-tasks-in-chatgpt?ref=skimwire.com)*.*