How to change your email on X (and who gets told)

#Quick answer

To change your email on X (formerly Twitter), open Settings and privacy, go to Your account, then Account information, and enter your password when X asks for it. Tap Email, type the new address, and confirm. X emails a verification code to the new address, and the change only lands once you enter that code. You do not need access to the old inbox, only your password.

Last updated: September 2026

#TL;DR

Swapping the email on an X account is a two-minute settings change with one password prompt and one verification code. Almost every guide stops there and misses the three things people actually search for afterwards: whether you need the old inbox (no, if you can log in), who finds out (the old address, automatically), and why X keeps refusing the new address (it is already on another account). There is also a security angle worth knowing before you need it, because changing the account email is the first move in most takeovers.

#How to change your email on X, step by step

On desktop

1. Click More in the left sidebar, then Settings and privacy.
2. Open Your account, then Account information.
3. X asks for your password before it will display anything on that screen. Enter it.
4. Click Email. Your current address appears, partly masked.
5. Type the new address and save.
6. X sends a verification code to the new address. Enter it to confirm.

On iOS and Android

1. Tap your profile icon, then Settings and privacy.
2. Tap Your account, then Account information.
3. Enter your password and continue.
4. Tap Email, enter the new address, and continue.
5. Open the new inbox, get the code, enter it, and confirm.

Nothing happens until that code is entered. If you close the app at step four, the account keeps the old address and you start again. The code lands within a minute or two on most providers, so if it has not arrived after five, check the spam folder before requesting another.

#The bit that trips people up: which inbox the code goes to

Search results for this are full of people convinced they are stuck because the old email is dead. A university address that expired, a work account they no longer have, a provider that shut down.

They are not stuck. The verification code goes to the new address, not the old one. X's own guidance for this exact situation says to log in with your username and password and update the email in Settings, and the alternative it offers is to do the same thing in the mobile app (X Help, accessed 2026-09-17). Being logged in is what proves you own the account. The old inbox never enters the process.

The old inbox only matters in the situation where you are already locked out, because then the password reset flow needs somewhere to send a code. Without access to the email or the verified phone number on the account, X says it cannot continue troubleshooting, which is a polite way of saying the account is gone. That is the entire argument for doing this today rather than the day something breaks: log in, change the email to one you will still control in five years, and add a phone number as a second route. If you are in that locked-out position now, recovering a compromised X account covers the escalation paths that remain.

#Who gets told, and why that matters

Every time the email on an X account changes, a notification goes to the previously used address (X Help, accessed 2026-09-17). You cannot switch that off, and you should not want to.

Here is why. An attacker who gets into an account does not start posting. They change the email first, because that moves every future password reset to an inbox they control and cuts the real owner out of recovery. The notification to the old address is the only signal the owner gets, and it usually arrives minutes before the password change that finishes the job.

So two habits are worth more than the rest of this page:

• Do not filter X's security emails. Plenty of people route everything from the platform into a "social" folder they check monthly. That folder is where the warning about your own account being stolen goes to die.
• Give the email account itself a separate strong password and its own second factor. Every recovery route on X runs through that inbox, which makes it the more valuable target of the two. Turning on two-factor authentication on X does nothing if the mailbox behind it opens with a password you reused in 2019.

If a notification about an email change arrives and it was not you, treat it as an active takeover rather than a glitch: change your X password immediately, which ends every other session, then set the email back.

#"This email is already in use"

Now the other common wall. You type the new address, and X refuses it.

The rule behind the error is that an email address can only be associated with one X account at a time. If the address you are moving to is already attached to something, even a dormant account you made years ago and forgot, the field will keep rejecting it. Three ways through:

Aliases are where people waste time. A separate mailbox or a real provider alias registers as a different address. Gmail's dot variations do not, because Google treats every dotted version of an address as the same mailbox. The full breakdown of what counts as a distinct address is in creating an X account with the same email.

#What changing your email does not do

Worth being precise, because assumptions here cause real problems.

• It does not log you out anywhere. Unlike a password change, which ends every session except the one you are using, an email change leaves your other devices signed in. After a suspected compromise, change both.
• It does not revoke connected apps. Anything you authorised keeps its access token until you remove it under Apps and sessions.
• It does not change your @username. Those are separate fields, and changing your username has its own consequences for links and mentions.
• It does not hide your email from people who already have it. That is a different setting, below.
• It does not move a subscription. If you pay for X Premium through the App Store or Google Play, the billing relationship sits with that store under whatever account you bought it with, not with the email on your X profile. Changing one does not touch the other.

#The setting most people never check: who can find you by email

Separate from the address itself is whether X lets other people match it to you. Under Settings and privacy, Privacy and safety, Discoverability and contacts, there is a toggle for letting people who have your email address find and connect with you on X.

It is on by default, which is convenient if you want colleagues to find your account and uncomfortable if you run a pseudonymous account from an address that is on your business card. The same screen holds the contacts you have uploaded from a phone, and a button to remove them all. Changing your email is the natural moment to look at both, since you are already in the settings and the new address probably has a different exposure profile than the old one.

#Bottom line

Settings and privacy, Your account, Account information, password, Email, new address, code. That is the whole mechanic, identical on every surface, and it needs your password rather than your old inbox. What deserves the extra minute is everything around it: keep the notification emails visible, because they are the only warning you get when someone else does this to your account; secure the mailbox behind the account at least as well as the account itself; and expect the "already in use" error if the address has any history on the platform.

Doing this from a browser you control, rather than a tool holding your session, is the general rule for anything account-level on X. That is the same principle X-Autopilot is built on: it works through your own logged-in browser on your Mac instead of asking you to hand a session to a cloud service, which is a smaller footprint than tools posting from a shared IP pool, though no browser-route automation is a sanctioned path under X's automation rules. If the account itself is the thing you are trying to protect, start at X two-factor authentication and work outwards.