Password · guide

How do I change IG password, and what the reset email hides

By Alberto Gulotta · Updated 10 September 2026 · 15 min read

How do I change IG password from the app: Profile, Menu, Accounts Center, Password and security, Change password, then pick the account. Locked out, it is the Forgot password? link and an email that carries two links, only one of which changes anything.

What Instagram asks of a password, beside what the public standard asks
	Instagram Help Centre	NIST SP 800-63B
Minimum length	“a combination of at least 6 numbers, letters and punctuation marks (like ! and %)”	“Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber”
Mixing character types	Recommended, in the same sentence	Advised against: verifiers “SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters)”
Changing it on a schedule	Not mentioned	Verifiers “SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)”, but “SHALL force a change if there is evidence of compromise”
Checking it against known-leaked passwords	Not mentioned	Required: verifiers “SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised”, including “passwords obtained from previous breach corpuses”
Where the setting lives	Accounts Center, then Password and security, then Change password, then choose the account	Not applicable

Instagram’s own order, from its help page for the Android and iPhone apps. The same five boxes appear on Instagram.com, with a menu instead of a profile tap.

In the app, start from your profile, not from settings. Instagram’s path begins at the bottom right: “Tap Profile or your profile picture in the bottom right to go to your profile.”
Menu in the top right, then Accounts Center. The same box that holds Facebook. If your account has never been linked to anything, it is still the route.
Password and security, then Change password. Then Instagram asks which account you mean, because Accounts Center can hold more than one.
Enter the current password, then the new one twice. Instagram’s advice for the new one is “a combination of at least 6 numbers, letters and punctuation marks”. Six is two below the minimum the public standard sets, so treat it as what the app will accept rather than as a target.
Locked out instead: Forgot password? on the login screen. If the reason you are locked out is that somebody else changed the address on the account, this reset is not the route and recovering a hacked account is. Otherwise Instagram accepts a username, an email address or a phone number, and then: “Enter username, email or phone, click Send login link.” The link goes to a contact method already on the account.
When the email arrives, choose the reset link and not the login link. Instagram states this one as an instruction rather than as a note: “Make sure you choose to reset your password by selecting reset your Instagram password in the email. Note: Do not choose to login from the email.”
If nothing works, an old email may have expired. Instagram’s first remedy is to ask for another: “You can request a new password reset email. The previous email may have expired.”
If you are here because somebody else got in, this is not the page you need first. Instagram keeps a separate route: “If you’re not able to reset your password this way, visit this page on your desktop or mobile browser to secure your account.”

The first box is the one worth reading twice: the same email carries two links, and only one of them changes the password.

The reset email that arrives and still does not work

There are two links in it, and only one of them is the one you want. Instagram writes it as a warning: “Make sure you choose to reset your password by selecting reset your Instagram password in the email. Note: Do not choose to login from the email.” The login link signs you in, which feels like success and leaves the password exactly as it was.

An email that no longer works has usually just aged out. Instagram’s remedy is to ask for another one: “You can request a new password reset email. The previous email may have expired.” That is the whole fix, and it is worth trying before anything more elaborate.

A reset email for an account that is not yours is a separate article. Instagram keeps one on receiving a reset email for the wrong profile, and another on receiving one you did not request. Neither is a fault in your password, and neither is fixed by changing it.

And if the account has been taken rather than forgotten, Instagram points elsewhere: “If you’re not able to reset your password this way, visit this page on your desktop or mobile browser to secure your account.” That flow asks for more than a password does.

Two characters and one rule apart. Both sides are quoted from the documents named in Sources, read on 7 September 2026.

Six characters, eight characters, and which number to use

Instagram publishes advice; the United States federal guidance publishes requirements. Where they disagree is small, specific and worth knowing.

The length Instagram’s note reads: “To create a strong password, use a combination of at least 6 numbers, letters and punctuation marks (like ! and %).” NIST Special Publication 800-63B sets a different minimum: “Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber.” The app is describing what it will accept. The standard is describing what a verifier should demand.

The mixing The same NIST section says the opposite of the familiar advice: verifiers “SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters)”, and “No other complexity requirements for memorized secrets SHOULD be imposed.” The reasoning is that mixing rules push a person towards a short password with predictable substitutions rather than a long one.

What the standard puts in their place Two things. Length, and a check against known-bad values: verifiers “SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised”, a list that “MAY include” passwords from “previous breach corpuses”, dictionary words, repeated or sequential characters, and “context-specific words, such as the name of the service, the username, and derivatives thereof”. Which rules out the name of the app itself.

So the practical answer Six will be accepted. Eight is the number a public standard is prepared to defend, longer is better than mixed, and the name of the service is the worst possible ingredient. If the password you are replacing was also used somewhere else, that other account is now the more urgent job — a leaked list makes a reused password worthless everywhere at once.

Why Instagram settings send you to a box with Facebook in it. Accounts Center is Meta’s shared place for Instagram, Facebook and Messenger, so the password screen sits there rather than in Instagram’s own settings, and it asks which account you mean even when there is only one to choose. Nothing is joined by this: each account keeps a separate password, and changing one leaves the other exactly as it was. The same arrangement is why the taps described on the Facebook side arrive at the same screen.

The reset is a link, not a code. Instagram’s wording is “Send login link”, and the thing that arrives is an email or a text with two options inside it. Selecting the wrong one signs you into the account without changing the password, which looks like the job is done and leaves the original problem in place. Instagram has a separate help page whose entire subject is links in the reset email that do not work, and its first two remedies are to pick the reset option and to request a fresh email because the old one expired.

What to do about the six. The app’s advice is a minimum it will accept, not a recommendation about safety, and the public standard is more demanding in one direction and less in another: longer, but without the mixture of character types that the app suggests in the same breath. If you would rather not decide, this is exactly the job a manager does for you, and the way in is the guides on passwords and the ways in.

What a new password does not settle. If somebody else has been in the account, the password is one of several things that may have moved: the email address on the account, the phone number, the linked apps and whether two-factor is switched on. Instagram routes a taken account to a different flow for that reason. Switching the second factor on afterwards is the change that survives the next leak, and what it is actually worth is on two-factor and two-step.

The click path, the six-character advice, the Send login link wording, the instruction not to sign in from the email, the expiry remedy and the route for a compromised account are quoted from three pages of the Instagram Help Centre, read on 7 September 2026 in the English (US) version of each. The minimum length, the composition rules and the breach-list requirement are quoted from NIST Special Publication 800-63B, read the same day. The comparison between the two is ours, and both sides of it are quoted rather than summarised.

Where to start

Four ways in.

“I am logged in and know the old one.”: Five taps — see the five taps
“The reset email does nothing.”: Two links, one of them wrong — the email with two links
“Is six characters enough?”: The app and the standard — six or eight
“Somebody else is posting.”: A password is not the whole job — after the change

The five taps

Instagram’s own path, which starts at your profile and ends in a box shared with Facebook. It asks which account you mean even when there is one.

Changing a Facebook passwordThe same Accounts Center, plus a daily cap and a phone number two-factor takes out of play.Open this guide → Resetting a Gmail passwordThe seven-day rule that decides whether recovery works at all.Open this guide → Sharing a wifi passwordThe prompt with six conditions, the code with none, and what each hands over.Open this guide →

The email with two links

One link signs you in and leaves the password alone. The other changes it. Instagram says which is which, in a sentence that is easy to walk past.

Reporting phishing in OutlookFour clicks, and the reason reporting does not block the sender.Open this guide → After a data breachWhat a reused password turns into once a company loses a list of them.Open this guide → When an authenticator stops workingThe clock, the app version, and a feature withdrawn rather than broken.Open this guide → A ChatGPT passwordThe opposite trouble with a reset email: one that is never sent at all, and why.Open this guide →

Six or eight

The app will take six characters mixed together. The public standard asks for eight and tells verifiers not to require the mixing at all.

Two-factor and two-stepWhat the standard requires, and why the two names are not the same claim.Open this guide → What a network security key isThe name Windows gives the same secret, and the protocol that decides what it is worth.Open this guide → Password-protecting a folderWhat device encryption covers, and where the recovery key for it lives.Open this guide →

After the change

A new password closes one door. An account somebody else reached has several others, and none of them is a password.

Turning two-factor offWhere the option still exists, where it has gone, and the two clean-ups afterwards.Open this guide → Erasing a locked iPhoneThree routes in Apple’s order, and the password that none of them can skip.Open this guide → Forgotten Mac passwordThe three reset routes, and the keychain that does not come back with the account.Open this guide → Changing a Microsoft passwordSix things share that name, and three of them are changed somewhere other than where you are looking.Open this guide →

Questions people also ask

How can I change my password on Instagram when I forgot it?

Use Forgot password? on the login screen. Instagram: “Enter username, email or phone, click Send login link.” A link goes to a contact method already on the account, and in that email you select the reset link rather than the login link.

Why can’t I change my password on Instagram?

The two reasons Instagram publishes are in the email rather than in the app: the reset email has expired, or the login link was selected instead of the reset link. Instagram’s own instruction is “Do not choose to login from the email.”

How can I find out my Instagram password without resetting it?

There is no route to it. Instagram documents changing and resetting, and nothing else. Meta says the same thing in plainer words on the Facebook side: it is “not able to send you a copy of your password without resetting it”.

Is six characters enough for an Instagram password?

It is what the app advises: “at least 6 numbers, letters and punctuation marks”. NIST SP 800-63B sets eight as the minimum for a password the person chooses, and tells verifiers not to require mixed character types at all.

Does changing my Instagram password change my Facebook one?

No. Accounts Center holds both, which is why the screen asks which account you mean, and each keeps its own password. The other path is on changing a Facebook password.

Not covered here. It does not cover Threads, which has its own password and its own pair of help pages even though the account behind it is the same one.

It does not cover recovering an account somebody else has taken. Instagram sends that to a different flow with identity checks, and a password change is not the first step in it.

And it does not compare password managers. That question has its own way in, the guides on passwords and the ways in. What holds instead is simple: the path, the wording of the reset email and the six-character advice are quoted from the Instagram Help Centre with the date they were read, and the eight-character minimum they are compared against is quoted from the United States federal guidance rather than asserted.

Locked out of an account, in four places

The same evening, four different companies. Each one publishes a condition that decides whether you get back in, and none of them shows it on the screen where the attempt fails.

The same job, in the other places it comes up: How to reset Gmail password when recovery keeps refusing; How do I change my Facebook password, and what stops a reset; How to factory reset iPhone without password or computer: 3 ways; Forgot macbook password, and what a reset quietly costs; Microsoft Authenticator app not working, and why the clock comes first

Sources

Instagram Help Centre — Change your Instagram password: the path through Accounts Center on each app, and the six-character advice for the new password — www.facebook.com, read 7 September 2026.
Instagram Help Centre — Recover your Instagram password: the three handles the reset accepts, the Send login link wording, and the route for an account you cannot recover this way — www.facebook.com, read 7 September 2026.
Instagram Help Centre — Links in password reset email from Instagram aren’t working: the expiry remedy, and the instruction not to sign in from the email — www.facebook.com, read 7 September 2026.
Facebook Help Centre — Send you a copy of your Facebook password without resetting it: Meta’s answer, on the Facebook side of the same Accounts Center, to being asked for an existing password — www.facebook.com, read 7 September 2026.
NIST — Special Publication 800-63B, Digital Identity Guidelines: the eight-character minimum, the composition rules verifiers are told not to impose, and the check against breach corpuses — pages.nist.gov, read 7 September 2026.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 7 September 2026 · last checked 10 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.