Updated November 2026
How to protect your Roblox account
Stolen Roblox accounts often start with something small: signing in on a fake page, running a “free Robux” script or reusing a leaked password. A few minutes of setup makes all of that much harder.
Turn on 2-Step Verification
2-Step Verification (2SV) asks for a second proof every time someone signs in from a new device. Even with your password, an attacker can’t get in without it. Roblox offers three methods:
| Method | How it works | Good to know |
|---|---|---|
| Authenticator app | A 6-digit code from an app such as Google Authenticator, Microsoft Authenticator or Authy. | The method Roblox recommends. |
| Roblox emails you a code when you sign in. | Needs a verified email. Only as safe as your email account. | |
| Security key | A hardware key (such as a YubiKey) or your device’s fingerprint or face unlock. | Needs the authenticator app as well, as a fallback if you lose the key. |
Set it up in four steps
Verify your email
Open Settings on roblox.com and add an email address you control. 2-Step Verification needs a verified email.
Open the Security tab
Under 2-Step Verification, turn on Authenticator App and scan the QR code with your app.
Save your backup codes
Generate backup codes in the same tab. Each one works once, so keep them on paper or in a password manager.
Add a second method
Add email or a security key too. If you lose your phone, you need two different methods to get back in.
Menus move around now and then, so if a button isn’t where this guide says, look under Settings, then Security, on roblox.com.
Enhanced Protection: for accounts worth a lot
Enhanced Protection is Roblox’s strictest setting. It only accepts sign-ins that can’t be phished, such as a passkey on your device or a hardware security key, and it switches off 6-digit app codes for 2-Step Verification. A fake login page can trick you into typing a code, but it can’t borrow your fingerprint or your YubiKey.
To turn it on you need at least one passkey, a verified email, and a verified phone number or backup codes. It is worth it if you own valuable limiteds, run a group or make money as a creator. For most players, the authenticator app plus backup codes is plenty.
Lock down your email too
Roblox uses your email to reset your password and to recover your account, so whoever controls your email can take over your Roblox account. Give your email its own strong password and turn on two-step sign-in there as well. If you still use an old school or family address, switch to one only you can open.
The four ways accounts get stolen
Fake login pages
A link in a DM, comment or video sends you to a page that looks like Roblox and asks you to sign in. Check the address bar: you should only ever sign in on roblox.com.
Cookie loggers
A “script”, browser extension, file or bookmark that promises Robux or free items, but sends your login cookie to someone else. With that cookie they can use your account without your password. Never paste code into your browser’s console or install extensions from strangers.
Reused passwords
If you use the same password on another site and that site leaks, attackers try it on Roblox. Give Roblox a password you use nowhere else.
“Free Robux” offers
Generators, “Robux codes” and giveaways that ask you to sign in, verify or download something. Robux only come from Roblox, so these always want your account, not to give you anything.
Our guides to Robux generators and trading scams show what these tricks look like in practice.
Someone got in: the first hour
Change your password
Do it on roblox.com straight away, and pick a password you have never used anywhere.
Log out of every other session
In Security, the “Where you’re logged in” list shows every device signed in to your account. Use the button at the bottom to log out of all sessions except this one.
Check your email and 2SV
Make sure the email, phone and 2-Step Verification on the account are still yours. If your email was changed, recover your email account first.
Contact Roblox Support
Use the support form and choose the hacked account option. Roblox only looks at recovery in limited cases, and you need to contact it within 30 days.
Act fast. Changing your password alone may not be enough if someone has your login cookie, which is why logging out of all other sessions matters. Afterwards, check your inventory and transactions so you can tell Roblox Support exactly what changed.
Frequently asked questions
What is the safest 2-Step Verification on Roblox?
Roblox recommends the authenticator app. A security key is even harder to phish, but Roblox asks you to keep the authenticator app on as a fallback. Email codes are the weakest option, because anyone who gets into your email can read them.
What is Roblox Enhanced Protection?
A stricter security mode in the Security tab. It only accepts phishing-resistant sign-ins, such as passkeys and hardware security keys, and turns off 6-digit authenticator codes for 2-Step Verification. You need at least one passkey, a verified email, and a verified phone number or backup codes to turn it on.
What is a cookie logger?
Code that steals the login cookie your browser keeps for Roblox. It usually hides in a “free Robux” script, browser extension or file. With that cookie someone can use your account without knowing your password, so changing your password and logging out of all other sessions is the fix.
Can Roblox give back items or Robux from a hacked account?
Not always. Roblox says it only restores accounts in very limited circumstances and doesn’t guarantee an account is put back the way it was. Contact Roblox Support within 30 days of the hack to have a chance.
I lost my phone with my authenticator app. How do I get back in?
Use one of your backup codes, or your second 2-Step Verification method such as email. That is why Roblox asks you to keep two different methods on your account.
Does FarmRBX need my Roblox password?
No. You sign in to FarmRBX with your Roblox username, Google or Discord. Any site that asks for your Roblox password or your login cookie is a scam.
Earn Robux without giving away your account
FarmRBX never asks for your password: sign in with your username, finish offers and surveys, and withdraw from 7 R$.