Password · guide

How do I change my Facebook password, and what stops a reset

By Alberto Gulotta · Updated 10 September 2026 · 17 min read

How do I change my Facebook password, logged in: profile picture, Settings and privacy, Settings, Accounts Center, Password and security, Change password. Locked out it is a different job, and three published conditions decide whether it works — none of which appears on the screen where the attempt fails.

1. Decide first which of the two situations you are in. If you are logged in and know the current password, you are changing it and nothing can go wrong. If you are locked out, you are resetting it, and the three conditions below decide whether that works.
2. Logged in: profile picture, Settings & privacy, Settings. Meta’s own path, in its order. On a phone the first step is Menu in the top right rather than a profile picture.
3. Then Accounts Center, then Password and security. Meta warns that you may not see it: “We’re gradually updating people to Meta Accounts. You may see either Accounts Center or Meta Account settings as the place to manage your account settings.” If Accounts Center is missing, select Password and security directly.
4. Click Change password, then pick which account you are changing. This step is there even for an account that has never been linked to anything: Accounts Center holds Facebook and Instagram together, so it asks which one you mean even when the list has one row.
5. Enter the current password, then the new one twice. If you cannot recall the current one, this is where you select Forgot your password? instead, and Meta sends a confirmation code to the email address on the account.
6. Locked out: use Forgot password? on the login screen, and search with the right handle. Meta accepts four: “Enter the email address, mobile phone number, full name or username associated with your account, then click Search.” A full name works when nothing else does.
7. If two-factor is on, do not expect your usual number to work. It is the one condition that stops a reset dead, and the fix has to be done before you are locked out, not after: add a second number or a second email address to the account while you still have access.
8. Do not go looking for the old password afterwards. There is no route to it. Resetting is the only way to have a working password again, and that is Meta’s own position rather than an inference from silence.

Why the screen asks which account you mean. Accounts Center is the place Meta now keeps Facebook, Instagram and Messenger together, so the Change password step opens a list even when there is only one thing in it. It is also why the same six taps work from either app. What it does not do is join the passwords: each account keeps its own, and changing one leaves the other exactly as it was. If you have never linked anything, the list has one row and the extra tap is the whole of the difference.

The daily limit is real and unpublished. Meta says only that “you can only reset your password a certain number of times a day”, without a number. In practice that turns repeated attempts into the thing that blocks you, so the useful move after a failed reset is to work out which of the three conditions you are failing rather than to try again. The most common is the plainest: the address on the account is one you stopped using, and the reset link is arriving somewhere you cannot open.

A passkey is the version of this page you only read once. Meta’s requirements for creating one are specific: a computer running “at least Windows 10, macOS Ventura, ChromeOS 109, or later, or a hardware security key that supports the FIDO2 protocol”, with Chrome 109, Safari 16, Edge 109 or Firefox 122 upward. In exchange, “when you create a passkey, you won’t need to enter your password to access your Facebook account or use Messenger”, and Meta states that “your biometric data, like a fingerprint or face scan, is never shared with Meta”. One detail is worth knowing before you start: the passkey takes its name from your confirmed email address, and “you can’t change your passkey name”.

What a new password does not fix. If the reason you are here is that somebody else got in, the password is one of several things they may have changed, and it is not the one they rely on to stay. Recovery email addresses, phone numbers, linked apps and login alerts are all worth reading immediately afterwards, and Facebook keeps a separate flow for an account that was actually taken rather than merely forgotten. A password change alone can leave a session open that never had to sign in again.

The click paths, the daily cap, the two-factor condition, the four handles the reset accepts, the passkey requirements and the refusal to send a copy of a password are quoted from four pages of the Facebook Help Centre, read on 7 September 2026 in the English (US) version of each. The storage requirement and the dropped composition rules are quoted from NIST Special Publication 800-63B, read the same day. The judgement about which condition to check first is ours.

Not covered here. It does not cover recovering an account that somebody else has taken, which is a longer route with identity checks rather than a password reset, and Facebook keeps it in a separate flow.

It does not cover Facebook Pages. Updating the password from a Page is a different Help Centre article because a Page has no password of its own: it inherits the account behind it.

And it does not rank password managers. That is a different question, and the way in is the guides on passwords and the ways in rather than this page. What holds instead is simple: every path, limit and condition on this page is quoted from the Facebook Help Centre with the date it was read, and the storage rule that explains why no password can be handed back is quoted from the United States federal guidance rather than asserted.