Account Security

To secure a ChatGPT account, open Settings > Security and login and turn on multi-factor authentication (MFA) with an authenticator app, push approval, a text code or a passkey (Managing multi-factor authentication). For the strongest protection, personal accounts can enroll in Advanced Account Security (since Apr 30, 2026), which turns off password sign-in and requires passkeys or security keys plus recovery keys. Lockdown Mode, a separate setting, guards against data leaking through prompt injection by limiting tools that reach the web.

Quick facts

How to turn on MFA in ChatGPT

1. Open Settings and select Security and login (the direct link is chatgpt.com/#settings/Security).
2. Under Multi-factor authentication (MFA), choose a method.
3. Follow the setup steps. MFA applies from your next sign-in.

The methods are an authenticator app (Google Authenticator, Authy and similar, set up by scanning a QR code), push notifications to a trusted device, a 6-digit text code by SMS or WhatsApp, and a passkey. With several on, OpenAI tries the most secure first, and you can pick any at sign-in. Email is not an MFA method. If you lose every method, OpenAI Support can verify you, which "can take a few days", and then issue a one-time email recovery login; after it, add a backup method (Managing multi-factor authentication).

Passkeys and security keys

Add a passkey at Settings > Security > Passkeys > Add passkey on the web. A passkey can be stored on a hardware security key such as a YubiKey, and eligible users in the US, UK and EEA can buy an OpenAI and Yubico bundle of two keys (a YubiKey C Nano and a YubiKey C NFC) at a reduced price (Passkeys; OpenAI + Yubico YubiKey bundle). Accounts without an email address cannot use passkey sign-in. A passkey kept on one device and not synced may be lost with that device, so keep a second method.

Advanced Account Security

Advanced Account Security is an optional setting for personal ChatGPT accounts against account takeover (Advanced Account Security). Enroll at Settings > Security > Advanced Account Security > Enroll: add at least two secure sign-in methods (passkeys, FIDO security keys or both, one of which works across devices), then save and confirm your recovery keys. You are then signed out everywhere and sign back in with a passkey or security key.

What changes once it is on:

• Password sign-in, email and SMS sign-in codes, and email account recovery are turned off.
• Email alerts are sent for every sign-in, and sessions are shorter.
• Your conversations are not used to train OpenAI's models.
• Each recovery key works once; using one starts recovery, and the account unlocks 48 hours later.
• OpenAI Support cannot reset your password, remove the setting or add sign-in methods for you.

It is not available on ChatGPT Enterprise or enterprise-managed accounts, and Business availability depends on configuration. To leave: Settings > Security > Advanced Account Security > Disable. Replace lost or exposed recovery keys at Manage > Replace recovery keys (Advanced Account Security). Since Support can only explain the recovery options left, store the recovery keys as carefully as the security keys themselves.

Active sessions and security history

Active sessions (since Jun 2, 2026) lists the devices signed in to your account and lets you sign out of any you do not recognize: Settings > Security > Active sessions. Security history (since Sep 25, 2026) shows sign-ins, sign-outs and changes to MFA, passkeys and other security settings: Settings > Security and login > Security history (ChatGPT release notes). Check both if you suspect someone else has used your account, then change your password or enroll in Advanced Account Security.

Lockdown Mode

Lockdown Mode is not about sign-in. It is for people who handle sensitive data and want to cut the risk that a prompt injection, hidden instructions on a web page or in a file, tricks ChatGPT into sending data out (Lockdown Mode). Turn it on at Settings > Security > Advanced security > Lockdown Mode, then Turn on. It:

• limits web browsing to cached content and stops showing images from the web;
• disables Deep Research and Agent Mode;
• blocks file downloads for Data Analysis and canvas network access;
• makes Finances in ChatGPT and shopping-agent experiences unavailable on personal accounts.

It leaves memory, uploads, sharing and training settings as they are, and Codex network access is unaffected. On the web you can turn it off for one chat from the LOCKDOWN MODE label in the composer. OpenAI is plain that it "does not guarantee" data cannot leak (Lockdown Mode).

Locked chats and the account PIN

The 4-digit account PIN that opens Locked Chats is changed at Settings > Security and login > Account PIN > Change. Resetting it deletes all locked chats (Using locked chats).

Two accounts and account switching

You can stay signed in to two ChatGPT accounts at once, for example a personal and a work account. On the web, add one from the account menu > Add account; on iOS and Android, Settings > Switch account > Add account (mobile since Oct 30, 2026). Each account keeps its own chats, memory, files and subscription; nothing is merged, and a new second account starts on Free. Check which account is active before buying a plan (Using multiple ChatGPT accounts).

Signing in elsewhere with ChatGPT

Sign in with ChatGPT lets partner apps such as Airtable, Notion and Vercel use your ChatGPT account, sharing only your name, email and profile image (Sign in with ChatGPT). See ChatGPT in Other Apps.

Frequently asked questions

How do I turn on two-factor authentication in ChatGPT? Go to Settings > Security and login, choose a method under Multi-factor authentication (authenticator app, push, text code or passkey) and follow the steps; it applies from your next sign-in.

Does ChatGPT support passkeys? Yes. Add one at Settings > Security > Add passkey on the web; it can also be stored on a hardware security key such as a YubiKey.

What is ChatGPT Advanced Account Security? An optional setting for personal ChatGPT accounts, since Apr 30, 2026, that requires passkeys or security keys plus recovery keys and turns off password, code and email sign-in.

What is ChatGPT Lockdown Mode? A setting in Settings > Security that limits web browsing and turns off deep research and agent mode to reduce the risk of data leaking through prompt injection.

How do I see where my ChatGPT account is signed in? Open Settings > Security > Active sessions to see and sign out of devices, and Security history for recent sign-ins and setting changes.

Can I use two ChatGPT accounts at once? Yes, up to two can be signed in at a time on web, iOS and Android, each with its own chats and subscription.

Sources

• Managing multi-factor authentication (MFA), OpenAI Help Center, read Nov 6, 2026
• Passkeys to secure your OpenAI account, OpenAI Help Center, read Nov 6, 2026
• OpenAI + Yubico YubiKey bundle, OpenAI Help Center, read Nov 6, 2026
• Advanced Account Security, OpenAI Help Center, read Nov 6, 2026
• Lockdown Mode, OpenAI Help Center, read Nov 6, 2026
• Using locked chats in ChatGPT, OpenAI Help Center, read Nov 6, 2026
• Using multiple ChatGPT accounts on web and mobile, OpenAI Help Center, read Nov 6, 2026
• Sign in with ChatGPT, OpenAI Help Center, read Nov 6, 2026
• ChatGPT release notes, OpenAI Help Center, read Nov 6, 2026 (entries Apr 30, Jun 2, Jun 4, Sep 25 and Oct 30, 2026)