Password Ideas for Instagram

Instagram accounts are stolen for their followers, their handle and their direct messages. Attackers resell short or popular usernames, use hijacked profiles to run crypto and giveaway scams on the owner's friends, and hold accounts for ransom. Most takeovers start in one of two ways: a password reused from an older breach, or a phishing DM that claims your account broke copyright rules or qualifies for a verified badge.

Instagram only requires 6 characters, which is far too short. Use at least 14 characters that have nothing to do with your handle, your name, your pet or anything visible in your bio, captions or tagged photos. A random password from the generator below, saved in a password manager, is the safest option. If you need to type it on your phone often, a four-word passphrase is easier to enter and still strong.

Then turn on two-factor authentication in Accounts Center under Password and security, and prefer an authentication app over text messages. Instagram also lists the security emails it has sent you, so you can check whether a message about a "suspicious login" is genuine before you click anything in it.