Secure your iTweet account

• At least 12 characters, mixing letters, numbers, and symbols.
• Never reuse the password you use for email, banking, or other social apps.
• Use a password manager (1Password, Bitwarden, Apple/Google Passwords).
• Change it immediately if you suspect it was ever entered on a non-iTweet site.

Go to Settings → Security Center → Two-Factor Authentication. Pick one:

• Authenticator app (recommended) — Google Authenticator, Authy, 1Password.
• SMS code — fine as a fallback; less secure against SIM-swap.
• Backup codes — download and store somewhere offline (not in your email).

An unverified recovery email is the single biggest reason people can't recover a hacked account. Confirm both are correct and belong to you — not a shared or old work address.

In Security Center → Active Sessions, log out anything you don't recognize. Mark only your personal phone and laptop as Trusted — trusted devices skip some 2FA prompts, so keep the list short.

Login alerts push a notification and email whenever your account is accessed from a new device or country. If you didn't do it, tap "This wasn't me" to invalidate the session and force a password reset.

Third-party apps you signed into with iTweet appear under Security Center → Connected Apps. Revoke anything you don't recognize or no longer use. Every connected app is a potential entry point.

• Turn on Login Approval so new sign-ins require confirmation from an existing device.
• Use IP Allowlist (Pro and above) to restrict admin actions to trusted networks.
• Enable Play Integrity Verification on Android to block sign-ins from rooted/tampered devices.

• Official iTweet emails come only from addresses ending in @itweet.com.
• We never ask for your password or 2FA code — anywhere, ever.
• Check the URL before entering credentials: it should be itweet.com, not 1tweet, itweeet, or a random subdomain.