Facebook login: signing in, recovery and account security

Almost everyone who has ever been online has a Facebook account, and almost everyone has, at some point, been shut out of one. The fb login screen is two boxes and a button, so when it stops working the reason is rarely the screen itself — it is a saved password that changed months ago, a phone number that no longer receives the code, or a browser holding on to a session that Facebook has already ended.

This guide covers the ordinary Facebook login on every surface people actually use — desktop browser, the mobile app, and Facebook Lite — and then the part most guides skip: what to do when the login fails, how account recovery really works, and which security settings are worth the two minutes they take.

What The Facebook Login Page Actually Is

The login page at facebook.com does one job: it matches an identifier to a password. The identifier can be the email address on the account, the mobile number on the account, or the username, if one was ever set. All three point at the same account, and any of them will work — which matters when you cannot remember which email you signed up with years ago.

Since Facebook and Instagram moved into the shared Accounts Center, one login can also carry across both apps if the accounts were linked. Linked or not, each service still has its own password unless you chose otherwise, so a working Instagram password is not proof that the Facebook one is current.

FB Login On A Desktop Browser

1. Go to facebook.com in any browser.
2. In the first box, type the email address, mobile number or username on the account.
3. In the second box, type your password. It is case-sensitive.
4. Select Log In.
5. If two-factor authentication is switched on, approve the prompt or enter the six-digit code.

If the browser has seen the account before, Facebook may show a profile picture and ask only for the password. That shortcut is a convenience on a personal machine and a liability on a shared one — on a public computer, use a private window so nothing is stored after you close it.

Staying Signed In, And When Not To

The Keep me logged in behaviour stores a session token in the browser. On your own laptop that saves time. On a machine anyone else can reach, it hands over the account without ever asking for the password again, which is why the safest habit on shared hardware is to log out deliberately rather than closing the tab.

FB Login On The Mobile App

1. Open the Facebook app on Android or iPhone.
2. Tap your account if it is listed, or Log into another account.
3. Enter the email or mobile number, then the password.
4. Complete two-factor authentication if it is enabled.

The app keeps accounts on the device after you log out, which is why a family phone can show several profiles on one login screen. Removing an account from that list is done with Remove account, not by logging out — logging out alone leaves the name and picture on the device.

Facebook Lite Login

Facebook Lite is a stripped-down build for slower connections and older Android hardware. The login is identical — same credentials, same account, same recovery — but the app is a fraction of the size and far less demanding on data. If the main app hangs on the login screen over a weak connection, Lite will usually get in where the full app cannot.

When The FB Login Fails

Most failed logins fall into a handful of patterns, and each has a different fix.

The password is rejected but you are sure it is right

Nine times in ten this is a password that was changed on another device and never updated in the browser or a password manager. It can also be caps lock, or a keyboard set to a different language layout. Try typing the password into a plain text field first to see exactly what is being sent.

The verification code never arrives

Codes go to the number or email already on the account, not to whatever you type at the time. A number you no longer use will silently swallow every code. Where the app-based option is available, an authenticator app removes this failure mode entirely, because the codes are generated on the device rather than delivered to it.

The account is temporarily locked

Repeated failed attempts, a login from an unfamiliar country, or an automated flag can put a checkpoint on the account. The lock is usually temporary. Work through the on-screen steps rather than retrying the password — more failed attempts extend the lock rather than clearing it.

The page loads but nothing happens

A stale session cookie will do this. Clear cookies for the site, or open a private window, and log in again from a clean state.

Recovering An Account You Cannot Access

Recovery starts from Forgotten password on the login screen and runs entirely through the contact details already attached to the account:

1. Enter the email or mobile number on the account to identify it.
2. Choose where the code should be sent from the options Facebook offers.
3. Enter the code and set a new password.
4. Log out of other devices when prompted, if you suspect anyone else has been in the account.

If none of the listed contact routes still reach you, the recovery flow becomes an identity check instead, which can involve submitting ID. That is slow and not guaranteed, and it is the reason the single most useful thing you can do today is open your security settings and confirm that the email address and phone number on the account are ones you still control.

Two-Factor Authentication, Set Up Properly

Two-factor authentication is the difference between a stolen password costing you an afternoon and costing you the account. It is under Settings → Accounts Centre → Password and security.

• Authenticator app — the strongest of the common options, and it works with no signal.
• SMS — better than nothing, but vulnerable to SIM-swap attacks and useless if you change numbers without updating the account.
• Recovery codes — generate them, then store them somewhere that is not the phone they protect.

The mistake worth avoiding is enabling SMS-based verification on a number you are about to give up. That converts a security feature into a lockout.

Keeping The Login Itself Safe

Facebook credentials are among the most phished on the internet, because one account often unlocks pages, ad accounts and years of personal history. Three habits cover most of the risk:

• Check the address before typing anything. A convincing copy of the login page costs an attacker nothing. Reaching the site from your own bookmark, rather than from a link in a message, defeats almost every phishing attempt on its own.
• Use a unique password. A password manager makes this painless, and it also means a data breach at some unrelated site cannot be replayed against your Facebook account.
• Read the login alerts. Facebook can notify you about unrecognised logins. Those alerts are only useful if someone reads them.

Where You Are Logged In

Under Password and security, the Where you're logged in list shows every active session — device, rough location and last activity. Anything you do not recognise can be ended from that screen, and ending a session forces that device to log in again from scratch.

This list is also the correct answer to the common problem of a phone that was lost or sold while still signed in. You do not need the device back; you end its session from any browser and, if there is any doubt, change the password immediately afterwards.

Facebook Business Login

Business Pages are not separate logins. You sign in with your own personal Facebook account, and the Pages and ad accounts you have been given access to appear inside Meta Business Suite. There is no separate "page password", which is why removing a colleague's access is done by changing their role in Business Suite rather than by changing a shared password.

Frequently asked questions