X warns users to re-enroll passkeys and YubiKeys for 2FA by Nov 10

Pierluigi Paganini
October 28, 2025

X urges users with passkeys or YubiKeys to re-enroll 2FA by Nov 10, 2025, or risk account lockout. Re-enroll, switch 2FA, or disable it.

Social media platform X is urging users who use passkeys or hardware security keys like YubiKeys for two-factor authentication (2FA) to re-enroll their keys by November 10, 2025, to keep account access. After that date, accounts without re-enrollment will be locked until users re-enroll, switch to another 2FA method, or disable 2FA, though X strongly recommends keeping 2FA enabled for security.

Users don’t need to take any action if they use other 2FA methods, such as authenticator apps.

By November 10, we’re asking all accounts that use a security key as their two factor authentication (2FA) method to re-enroll their key to continue accessing X. You can re-enroll your existing security key, or enroll a new one.

A reminder: if you enroll a new security key, any…

— Safety (@Safety) October 24, 2025

The company clarified that the re-enrollment of security keys and passkeys is due to the migration from twitter.com to x.com, not a security incident. Keys tied to twitter.com will stop working after November 10.

To clarify: this change is not related to any security concern, and only impacts Yubikeys and passkeys – not other 2FA methods (such as authenticator apps). Security keys enrolled as a 2FA method are currently tied to the twitter[.]com domain. Re-enrolling your security key will… https://t.co/PlXOTnNXPM

— Safety (@Safety) October 26, 2025

In October 2022, SpaceX and Elon Musk bought Twitter and rebranded it as X in July 2023. The request to re-enroll the users’ key to continue accessing the social media platform is due to the new owners’ decision to retire the twitter.com domain.

Users must re-enroll, switch to another 2FA method, or disable 2FA (not recommended) to regain access. The process requires visiting x.com/settings, disabling old keys, re-enrolling, and confirming with a password.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Twitter)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts