Problèmes de mot de passe Instagram : l'e-mail non sollicité, la modification qui échoue et les codes que personne n'envoie

Look at what people actually type. The busiest searches around this subject are not "how do I change my password". They are "password change request email", "not me", "keep getting them", "changed not by me", "not working", "something went wrong". Almost nobody is stuck on the click path. They are stuck on something that happened to them.

So the click path is section four. First, the two situations that bring most people here.

You got a password reset email you did not ask for

This causes more alarm than it should. A reset link means somebody typed your username or email into the "Forgot password?" form. It does not mean anyone got in and it does not mean the password changed: the link does nothing until it is opened and used, and it goes only to the address already on the account. So the rule is simple. Do not open it, not even to look. Ignore it and the request expires.

Two readings are worth making. Repeated requests are a signal about your username being on somebody's list, not about your password, and nothing you do to the password stops them. But a reset email arriving alongside a login alert is a different event: that pair means somebody is further along, so go to the active-session list first.

The mail that should genuinely worry you is a confirmation that something already happened, that the password was changed or the address on file was updated. That is a takeover in progress, and the reset link inside it is your route back while it is still live.

The password is right and it still will not accept it

This is the "invalid credentials" and "not working" search, and most of the time it is not the password.

Likely cause	How to rule it out
Phone keyboard capitalised the first letter	Reveal the field and read what is actually in it
A space on the front or back, from pasting	Type it by hand once instead of pasting
The password manager is filling the pre-change value	Clear the autofill and type it once
It genuinely was changed by someone else	Search your mailbox for a change confirmation
It is not a password wall at all	Read the wording on screen rather than assuming

That last row is the one that wastes the most time. A code that never arrives, a demand for a photo or a short video to confirm who you are, and a generic English error about your request are three separate walls with three separate answers, and none of them is fixed by trying the password again. Retrying is actively harmful on the third kind, which is a rate limit and gets longer the more you push it. The login guide sorts those out one by one.

What the rules actually are, and where to find out

People search for Instagram's password requirements, and the honest answer is that they are not published anywhere you can read without being in the form. No readable help page states a minimum length or a required mix of character types. The form itself is the only authority, and it will tell you on your own screen the moment your entry is too short.

Which is fine, because the platform's floor was never the useful advice. Length past twelve characters does more than swapping a zero for an O, and using the password in exactly one place does more than either, because accounts are very rarely brute-forced and very often taken after a different site leaked the same pair. Beyond that, the password is not what decides who owns the account at all: the recovery mailbox, the phone binding and the two-factor secret do, and the account-safety guide works through that layer properly.

The two routes to change it

If you can log in. From your profile, go into settings, then the accounts area, then password and security, and choose to change the password. Enter the current one, then the new one twice. It applies immediately and changes nothing about your followers, posts, stories or saved content. Only who can log in.

If you cannot. On the login screen, use "Forgot password?". Give the username, email or phone on file, choose how to receive the code, enter it and set the new password. If the account has ever been linked to a Facebook login, that route usually resolves fastest, because it skips waiting for a code.

If the code never arrives, check spam, then check something more fundamental: whether that mailbox and that number are still yours. If they are not, this stopped being a recovery problem and became an ownership problem, which the self-service flow cannot solve.

The order that matters on an account you have just taken over

Doing these in the wrong sequence is how people lose an account halfway through securing it. The sequence is sessions, then password, then bindings.

1. Read the active-session list first. It shows every device currently signed in, with a device type and a rough location. End anything you do not recognise, before the change, so you know what you are starting from.
2. Change the password, then read that list again. Whether the change ended those sessions is not something you can confirm from any page you can read, so treat the list as the thing you check rather than the thing you infer.
3. Then the bindings. Recovery email, then phone, then two-factor. Last, because these are the most sensitive actions on a freshly changed account and the likeliest to trigger an extra verification.
4. Review connected third-party apps while you are in the security area. Standing app access is not affected by a password change, and revoking anything unused costs nothing.

Keep the network stable for the first few days after all this. A fresh password plus a run of connections from different places is one of the patterns most likely to land you in an extra verification step, and the checklist for logging in from a different country is in the overseas IP guide.

Two-factor, and the item almost nothing ships with

Three second factors are available and they fail in different ways. An authenticator app does not depend on a phone number, so it survives changing carriers or countries, and it dies with the phone if you never migrated it. SMS needs nothing installed and breaks on exactly the things travel does to a number. Backup codes depend on no device and no network, and they are lost the moment the only copy is a screenshot in the same phone's camera roll.

So the combination that survives is an authenticator app plus backup codes stored somewhere else. The codes are shown when you switch two-factor on, and that is the one opportunity.

Here is why this is worth more than a paragraph of general advice. Across 2,129 live Instagram account listings on this marketplace on 31 August 2026, about seven in ten advertise a two-factor secret as part of what you receive. Three of them mention backup codes. Not three per cent. Three listings.

The pricing says the same thing from the other side. On every one of the nine sellers holding thirty listings or more, the two-factor listings sit at or below that seller's own median price. It is not a premium feature; it is the default packaging. Stated mailbox access is the opposite: on five of the seven sellers with enough of them to compare, listings with mail access cost more than that seller's own median, on one of them by around five times.

Read together: the seed is a commodity, the mailbox is the priced good, and the recovery codes are essentially never handed over. So on any account that arrives with two-factor already switched on, the correct first move once you have the account stable is to turn it off and switch it back on under your own authenticator, which regenerates the codes and puts a set in your hands for the first time. If you need to turn a supplied secret into a working six-digit code in the meantime, the TOTP guide covers the format and what to check when the code is rejected, and there is a generator at the on-site tool.

One more thing about turning two-factor off: it requires being logged in. It is not a way back into an account you are already locked out of, which is what people are hoping when they search for it.

If two-factor is lost and there are no codes

Ordered by what you still have.

• A backup code. Use one, get in, then immediately reset two-factor and generate a fresh set. This is the only clean route.
• No codes but the bound phone still receives SMS. At the prompt, look for the option to verify another way and see whether SMS is offered.
• Nothing. What remains is the platform's identity appeal, which typically asks for a short video or supporting material. There is no promised timeline and no promised outcome, and on an account you acquired from someone else you are unlikely to be able to supply the original registration details it asks about.

Which is the argument for the thirty seconds spent saving the codes. If the account was handed to you and is linked to a Facebook account as well, the same order applies on that side, and Facebook accounts are listed here with the same attributes stated separately. Meta's own Business Help Center is the official route for recovery cases beyond self-service.