Securing your Roblox account: how to set up 2-step verification

A password is a key. Whoever has it can get in. 2-step verification adds a second proof to signing in, and anyone who wants to get in needs that too. This keeps a Roblox account well protected even if the password has been lost, as long as nobody passes on the sign-in code, types it into a fake page or approves a sign-in attempt by someone else. On Roblox, the setting is in the account settings, on the Security tab.

As of 25 September 2026. On this day we checked the BSI recommendations on two-factor authentication and on passwords, the Roblox Help articles on 2-step verification, account security, passkeys, free Robux and voice chat, the Roblox technical documentation, the Roblox pages on parental controls and safety, and the klicksafe (a German EU initiative for online safety) news item of 26 August 2026 on its new Roblox topic section.

Why a password alone is not enough

The BSI sorts sign-in factors into three groups: knowledge (password, PIN), possession (chip card, TAN generator) and biometrics (fingerprint). A password is pure knowledge. Knowledge can be passed on, seen by someone looking over your shoulder, guessed or typed into a fake copy of a sign-in page. If a second factor from a different group is added, the stolen knowledge alone is no longer useful.

The BSI recommends word for word: “Wenden Sie eine Zwei-Faktor-Authentisierung an, sobald ein Online-Dienst dies ermöglicht.” (Use two-factor authentication as soon as an online service offers it.) It also points out that many services offer the feature but leave it switched off by default. So it is worth checking. And once it is on, the BSI advises against switching it off again in any case. This is exactly where things can get tense at home, because the second step costs a few seconds every time someone signs in with the password.

How to turn it on

According to Roblox Help, it works like this:

1. Sign in to the Roblox account.
2. Open the account settings: in the browser via the gear icon at the top right, in the app via the icon with the three dots and then the gear icon.
3. Choose the Security tab.
4. Turn on the switch for the method you want and follow the instructions on the screen.

Check first: the account needs a verified email address, otherwise 2-step verification cannot be turned on. According to Roblox, you can currently only choose one method (for the security key, you also need the authenticator app, see below).

Which second steps Roblox offers

To turn it on, Roblox Help lists three methods: a code by email, a code from an authenticator app and a security key. For the security key, the authenticator app must also be turned on. It then stays as the backup in case the key gets lost. The key can be a small device or unlocking your own device, for example with face recognition or a fingerprint. Which of these works depends on the browser, operating system and device. Roblox can also ask during sign-in for a confirmation on a second phone or tablet where the account is already signed in. There, the sign-in attempt can be approved or declined. In its article on account security, Roblox explicitly recommends the authenticator app.

Roblox itself names one exception: anyone who signs in with a passkey does not have to do the second step. Roblox does not see this as a security problem, because signing in with a passkey already shows that you own the device. At the same time, Roblox advises against setting up passkeys on shared devices, because anyone who can unlock such a device can also get into the account. And passkeys carry over to all devices with the same Apple, Google or Windows account. With the email method, the second step is also skipped when signing in with a one-time code by email. With the app method, however, Roblox asks for the code in that case too. So the second step does not apply to every sign-in.

The technical documentation for developers lists more methods, including SMS. Roblox Help for users does not list SMS as a way to turn it on, so we do not rely on it here.

For everyday life with children, this means: if the authenticator app runs on a parent’s phone, every sign-in with the password needs that phone. If the child has set up a passkey, their sign-in no longer needs the parent’s phone. With the email method, what matters is who opens the inbox. If the child reads the emails themselves, the second step is in their hands. And the BSI advice on SMS codes carries over: if possible, do not receive the code and sign in on the same device, otherwise the factors are not separated.

Recovery codes belong with the parents

Recovery codes are the way back if the device with the authenticator app is broken, lost or sold. You create them in the account settings on the Security tab, in the Recovery Codes section, via Generate. Roblox asks for the account password when you do this.

Roblox shows the codes only once. So save or print them right away and keep them outside the device: printed out in a drawer or in a password manager the parents can open even without that phone. Each code works only once. Creating new codes makes all the old ones invalid. Roblox Help does not say how many codes there are.

Even more important is a rule Roblox sets for emergencies: anyone who has turned on 2-step verification and loses access to their main method needs two different verification methods on the account to get back in. As backups, Roblox lists a phone number, a passkey and the recovery codes. Passkey and codes are available at any age, the phone number only from age 13. According to Roblox, anyone who has not added enough of these may not be able to get back into the account. For a child’s account, this means: create recovery codes on the same day you turn on the second step.

The password in front still matters

The second step does not replace a proper password. The BSI gives three examples of a secure password: 20 to 25 characters from two types of characters, for example several words in a row; 8 to 12 characters from four types of characters; or 8 characters from three types of characters if a second factor also protects the account, which on Roblox means 2-step verification. Elsewhere, the BSI says long passwords should have at least 25 characters, so go for 25 there. It should never be fewer than eight characters. As a rule, you can use all available characters, for example upper and lower case letters, numbers and special characters.

A practical tip from the BSI: it is better to avoid umlauts (German letters like ä, ö, ü), because they sometimes do not work with services and keyboards that are not in German. And because nobody can remember a separate long password for every account, the BSI recommends a password manager, protected by a strong master password.

How to set up an account properly from the start is explained in our guide Create a Roblox account.

How login details get lost in the first place

According to Roblox, players most often lose their account because they give their login details directly to others or fill out online surveys. A popular bait is free Robux. Roblox says every offer of free Robux is a scam. The people behind it want the password and with it the account. What is behind such pages is explained in our guide Are there free Robux codes?. People also cheat when trading in games like Murder Mystery 2. How exactly is explained in the parents’ guide Spotting MM2 scams.

The rule for kids is short: you only type your password on the Roblox sign-in page. You never give anyone your sign-in codes or recovery codes. According to Roblox, Roblox staff never ask for them. Anyone who asks wants the account. And if a sign-in attempt that you did not start shows up on your phone, decline it and tell your parents. According to Roblox, someone may then have your password, so change it afterwards together.

What parents can also set up

2-step verification protects the sign-in. What happens inside the account is handled by parental controls. Roblox describes it like this: the child sends a request from their settings to a parent’s email address. Through this email, the parents sign in with their Roblox account or create one and link it to the child’s account. According to Roblox, anyone creating a new account for this should have an official ID ready. When linking, parents confirm their age with an ID or a credit card.

According to Roblox, this linked parent account lets you set: the age rating of content, chat and voice chat, daily screen time, a monthly spending limit, and the friends list, which you can view and from which you can block and report. In most countries, this fully applies only up to age 12. According to Roblox, some settings, such as direct chat, can be managed up to age 15.

On top of that come the limits already built into the account type. Roblox names Roblox Kids for ages 5 to 8 and Roblox Select for ages 9 to 15. On Kids accounts, chat is off by default. On Select accounts, it is on by default, with age-appropriate users and trusted friends, and for children under 13 parents can turn it off. For voice chat, Roblox’s information is not consistent: the safety page says it is not available for 9 to 12 year olds, and Roblox Help says the same for everyone under 13. Only the English version of the parental controls page says parents can turn on voice chat with trusted friends for 9 to 12 year olds. What applies to you can be seen in the parental controls of your account.

klicksafe gives parents tips on topics including parental supervision, safety settings, contacts, gifts and dealing with the in-game currency Robux. As risks, klicksafe lists things like unsuitable content, contact with other players, incentives to buy and long playing times, and points out that Roblox is rated for ages 16 and up in Germany.

Where the information comes from

The recommendation on the second factor, the three factor groups and the note on the SMS method are on the BSI page Zwei-Faktor-Authentisierung (two-factor authentication, in German). The password rules and the advice on password managers are on the BSI page Sichere Passwörter erstellen (creating secure passwords, in German). The click path, methods, the passkey exception, recovery codes and the emergency rule are in Roblox Help under Add 2-Step Verification to Your Account. The recommendation for the authenticator app and the most common cause of lost accounts are under Keep Your Account Safe, the warning about free Robux under Free Robux or Subscription Generators. Why Roblox skips the second step with a passkey and why passkeys do not belong on shared devices is under Logging in with a Passkey, the age limit for voice chat under Voice chat with friends and unfiltered texting. The methods from a developer’s point of view are described in the Roblox documentation on Two Step Verification. Roblox describes parental controls and the linked parent account under Parental Controls, and the account types and chat rules under Safety. The German perspective for families comes from klicksafe (in German), as of 26 August 2026.

Conclusion

The second sign-in step is a setting you make once and then hardly ever touch again. It costs a few seconds every time you sign in with the password, and a stolen password alone is then no longer enough to sign in. The only important thing is to create the recovery codes at the same time and keep them where the parents can find them and where a broken phone cannot take them with it.