Protect yourself and your data when using X

Updated 26 February 2025

Read this guide to learn how to secure your X account.

Consider if relying on commercial, corporate products is secure enough to protect your information. Commercial corporations might not share your values and remove or filter content that they believe violates their policies. It may also be difficult for them to understand your local context, particularly if they do not operate in your language.

If you are considering leaving X, read our tips on leaving X and moving to alternative platforms.

Inform yourself about X's policies

Learn how X uses your information

• You can find a clarification of X's terms of service on Terms of Service; Didn't Read.
• Learn about X's privacy policy.
• Also review other X rules and policies, in particular their rules on content and conversations and their terms of service.

Learn what X will turn over to governments or law enforcement

• Read X's guidelines for law enforcement.
• See X's transparency reports and X's transparency center.

Don't use the mobile app

• Do not use the app on your mobile device. Connect using a browser instead.
  • If you really need to use the app, consider using a separate device from the one you normally use.
  • In alternative, if you have an Android device, you can isolate the app in a separate profile.

Create a new account

You can create an X account for free.

Decide whether you will use a real or fake name, and maintain separate accounts

• Be aware that even if you provide a fake name to X, you may still be identifiable by the network you connect from and the IP address it assigns to your device unless you use a VPN or Tor to hide this information.
• Consider using separate accounts or separate identities/pseudonyms for different campaigns and activities. You will likely want to keep your personal and work accounts separate, at the very least.
  • Read more on this strategy in our guide on multiple identity management.
• Remember that the key to using a social networking platform safely is being able to trust the people you connect with. You and the others in your network will want to know that the people behind the accounts are who they say they are, and have ways to validate this. That does not necessarily mean you have to use your real name, but it may be important to use consistent fake names.
• On X, you can consider paying for a premium account to get a badge that verifies your identity.
  • Learn more on how to verify your account.
  • Learn more on X Premium accounts.

Set up with a fresh email address

• Set up a new email address on a privacy-friendly server. You can find a list of suggested privacy-friendly mail services in the communication tools section.
• If you need to protect your identity while setting up new email use the Tor Browser or a trusted VPN.
• Disable the option to find you by your email address.

Don’t associate your phone number with your account

• If possible, when setting up a new account, do not enter your phone number. X will allow you to set up a new account with only an email address, and that can be harder to associate with you.
  • Disable the option to find you by your phone number.
  • Note that if you decide to get your account verified you'll be required to provide a phone number to X.

Don't upload your contacts to your X account

• Dismiss X's requests to upload contacts stored on your device, connect with your other social media accounts or find more connections when you first set up an account. You can select your contacts more carefully afterwards.
  • Learn how to remove contacts and turn off contacts syncing.
  • Disable the option to find you by your email address or phone number.
• Consider only connecting to people you know and whom you trust not to misuse the information you post.
• If you need to connect to an online community of like-minded individuals whom you have never met, consider carefully what information you will share with these people.
• Do not share your employer or educational background, as social media may use this information to share your profile with others unexpectedly.

Designate someone to manage your account if you are unable to do it yourself

• Note that for legal reasons, X will not give a loved one or colleague access to the account of an incapacitated or deceased person. Rather, they will deactivate the account if they receive a request from immediate family members or a person authorized to act on behalf of the user.
  • Review the requirements for removing a deceased or incapacitated user's account.
• If you expect someone else may need to access your account quickly in the event of an emergency, arrange to share your login information with them using secure communication.
• If someone you know has been arrested or detained and you need to suspend their account so as to stop others from accessing their network of contacts or compromising information, you can reach out to Access Now Digital Security Helpline or Front Line Defenders to request assistance in working with X to secure access to their accounts. Also read the Digital First Aid Kit troubleshooter Someone I Know Has Been Arrested for further recommendations and see the Digital First Aid Kit support page to look for help desks that may support you for specific needs.

Know how to move your data out of X

• Test how to download your data from your X account. Start the download process, then take a thorough look at what data it provides. Assess what has been downloaded, in what format and how you can read and use it.
  • Learn how to access your X data.
  • Learn how to download your X archive.
  • Allow some time for this process. If you have had an account for a long time, there will be a lot of data to download, and the service may take a day or so to bundle it for your download.

Protect your account

Check your recovery email and phone number

• Check your recovery email.
• Check your recovery phone number.
• Change this information immediately if you lose access to your recovery email address or recovery phone number.

Use strong passwords

Use strong passwords to protect your accounts. Anyone who gets into your X account will gain access to a lot of information about you and anyone you are connected to.

• See our guide on how to create and maintain strong passwords for more information.

Set up two-factor authentication (2FA)

• Use a security key, authenticator app or security codes for two-factor authentication.
• Do not use SMS or a phone call if possible, as your mobile phone company has full access to these communications and these methods are easier to hack into. Note that we don't recommend associating your usual phone number with your account, especially if your official name is not already associated with your account.
• Learn how to use two-factor authentication on X.
• Also read X's recommendations on how to secure your account, including enabling "Additional password protection" in your security settings.

Save the backup code to get back into your account

• A backup code is automatically generated for you when you turn on two-factor authentication on X.
  • Store the code in your password manager.
  • Alternatively, print this code out before you are in a situation where you might need it. Keep it somewhere secure and hidden, like a locked safe.
  • Learn how to generate a new backup code through your X app.

Be very careful with emails or messages claiming to be from X

• X does not provide a list of alerts it may have sent you, but suggests evaluating whether an email is real using their guidelines on fake emails.

Create an alternative identity

• If you want to use X without connecting it to your real identity, make sure to create your X account through the Tor Browser and to never connect with your actual IP. Also make sure to create your account with an email address that you created using Tor or a VPN.
  • Note: Twitter / X used to have an .onion address, and the Tor Browser will still suggest you to open X through the .onion address. But unfortunately this address does not work any longer: it gives a warning about an expired certificate, and you should not accept that for any reason. If you want to access X through the Tor Browser, just use the normal X.com address.

Check suspicious access

Check active sessions and authorized devices, review account activity and security events

• Look at the pages listing which devices have recently logged in to your account (including browsers or apps). Does every login look familiar?
  • Look for instructions on how to log out devices that are not yours.
  • Note that if you are using a VPN or Tor Browser, which can conceal your location, your own device may appear as connecting from unexpected locations.
• If you see suspicious activity on your account, immediately change your password to a new, long, random passphrase you do not use for any other accounts. Save this in your password manager.

Get notified about logins

• X automatically sends notifications of logins from new, unknown devices to your recovery email and/or app. Make sure to check regularly the recovery email you set for your X account.

If you think your account has been hacked

• Learn how to recognize a hacked account and take steps to remedy it.
• If you can't solve this issue through the standard procedure, check out the Digital First Aid Kit troubleshooter I lost access to my account.

Review other sites and apps that can access your account

• Avoid using your accounts to log in to other sites (like news sites for example). While it may be convenient to use your X account as a login option, you may be also making it easier for attackers to exploit this functionality and you may leave more evidence of what you have viewed online. Use a different password for every site, and save it in your password manager.
• Be careful when connecting your accounts. You may be anonymous on one site, but exposed when using another.
• Read about log in sessions, third-party apps and their permissions, and learn how to log out of active X sessions.

Consider what information you should avoid sharing

Information that should never be shared with others on social media, even via direct messages (DM), may be, for example:

• Passwords
• Personally identifying information, including:
  • your birthday,
  • your phone number (does it appear in screenshots of communications?),
  • government or other ID numbers,
  • medical records,
  • education and employment history (these can be used by untrustworthy people who want to gain your confidence.)
• Information that may lead to understand where you live, for example a picture of your house.

Information that you might not want to post on social media, depending on your assessment of the threats you are facing, is, for example, details about family members, information on your sexual orientation or activities and your email address (at least consider having more and less sensitive email accounts).

• Even if you trust the people in your networks, remember it is easy for someone to copy your information and spread it more widely than you want it to be.
• Agree with your network on what you do and do not want shared, for safety reasons.
• Think about what you may be revealing about your friends that they may not want other people to know; be sensitive about this, and ask them to be sensitive regarding what they reveal on you.

Don’t share your location

• Make sure to turn off the location feature to avoid showing where you are posting from.

Share photos and videos more safely

• Consider what is visible in photos you post. Never post images that include:
  • your vehicle license plates,
  • IDs, credit cards or financial information,
  • photographs of keys (it is possible to duplicate a key from a photo.)
• Think hard before you post pictures that include or make it possible to identify:
  • your friends, colleagues and loved ones (ask permission before posting),
  • your home, your office or other locations where you often spend time,
  • if you are hiding your location, other identifiable locations in the background (buildings, trees, natural landscape features, etc.).
• Remove metadata before you post photos, videos and other files.

Don't share your birthday

• On X, you can register with a birthday that is not your own, and you can change your birthday also later, although only for a limited amount of times.
• Learn how to remove your birth date if you have previously added it.

Decide who can see what

Share to select people

• Consider protecting your posts and letting only selected people see them.
  • Learn how to protect your account.
• Note that if you previously had a public account, your past posts can still be found on archive websites. You may want to start a new account for plausible deniability.

Manage who can reply to what you post

• Learn how to decide who can reply to a post, choosing "Everyone," "Only accounts you mention," "Accounts you follow" or "Only verified accounts," depending on your preference.

Think about who you connect with

• Unfollow people.
• Deny requests to follow you.
• Manage lists that you make or that someone has put you on.

Review tags/disallow tags

• Read X's support page on how to post photos to learn how to avoid being tagged in photos, how to look for photos you're tagged in and how to remove your name or username from a photo you're tagged in.

Limit who can contact you

• Block accounts so they cannot contact you.

Manage advertising

• Uncheck the Personalization and data option in your settings.

Leave no trace

Precautions when using a public or shared device

• Avoid logging in to your X account from shared devices (like an internet cafe or other people's devices).
• Never save your passwords and delete your browsing history when you use a web browser on a public machine. Change the passwords of any accounts you accessed from shared devices as soon as you can, using your own device.

Handle abuse

This section explains how to ask X for assistance in situations of abuse, harassment, attacks and impersonation. If you are a human rights defender, journalist or activist at risk and X is not assisting you effectively, you can reach out to Access Now Digital Security Helpline or Front Line Defenders to request assistance in working with X. Also see the Digital First Aid Kit support page to look for help desks that may support you for specific needs.

Report abuse

• Learn how to report abusive behavior.
• Find country-specific resources to report abuse or appeal against a decision.

Report harassment that reveals information about you

• Report posts containing private and confidential information.

Identify and report coordinated inauthentic activity (botnets and spam)

• Learn what kinds of automated activity are and are not acceptable, and how to report activities that violate the rules.

Report impersonation

• Learn how to report impersonation.

Hide stressful content

• Learn what steps you can take to control your X experience and hide content that is distressing to you, including unfollowing, muting or blocking accounts, filtering the types of notifications you receive and controlling the media you see in posts.

Learn how to recover your account if it is disabled or suspended

• Learn more about suspension.
• Request your account be re-activated.

Take a break from your account

X does not support temporarily suspending your account. However, if you plan to return to your account within 30 days, and will still have access to the same email and phone number you registered with, you could consider fully deactivating it. This process is more difficult, as if you don't log in within 30 days there is a risk you will lose your account name and someone else could take it over.

• Learn how to deactivate your account.