X login: sign in at x.com and fix what blocks you

#Quick answer

To do an X login, go to x.com in any modern browser, click Sign in, and enter your username, email or phone number along with your password. Clear the two-factor prompt if you have one turned on, and you are in. Sign in with Google or Apple works too, and the old twitter.com address redirects to x.com, so both land in the same place.

Last updated: September 2026

#TL;DR

X (formerly Twitter) runs fine in any browser on desktop or mobile, and you do not need to install anything. The sign-in itself is three fields. What trips people up in 2026 is everything around it: an Android app that tells you to go and use x.com while you are already inside the official app, a "we've temporarily limited your login" message that turns out to be your ad blocker rather than your password, a security-key change that locked out passkey users, an account switcher people never find, and a search results page stuffed with tools selling you a "safer" way to log in that you do not need.

So the order below is deliberate. Sign-in first, then the two failures that no password reset touches, then the ordinary cookie, cache and rate-lock fixes that solve everything else.

#How to log in to X on the web (desktop, step by step)

1. Go to x.com. Type it into the address bar or use a saved bookmark. Do not click a login link from an email or DM you did not expect. That is how phishing kits harvest passwords. If you land on the old address, it redirects to x.com automatically.
2. Click Sign in. On the x.com landing page the button is top-right on desktop and in the sign-in card on mobile web.
3. Enter your identifier. Your @username, the email on the account, or the phone number all work. Username is the one to use if you have forgotten which email the account was opened with.
4. Enter your password, or choose Sign in with Google or Sign in with Apple if that is how the account was created. Picking the wrong one of those three is a surprisingly common cause of "wrong password".
5. Clear two-factor authentication if you have it on. X will ask for an authenticator code, an SMS code, or a passkey or security key, depending on what you enrolled.
6. You are in. The web feed loads with the same timeline, DMs and settings you get in the app.

That is the whole thing. If it did not work, the reason is almost always one of a short list, which is the next section but one.

#Signing in from a phone browser

You do not need the app on a phone either. Open x.com in Safari or Chrome on the handset and the same sign-in card appears, sized for the screen. Two things are worth knowing.

First, mobile browsers are much more aggressive about blocking cookies, and X's sign-in flow needs them. If Safari's Prevent Cross-Site Tracking or a content blocker is on, the login page can reload endlessly without an error message. Turn the blocker off for x.com and try again.

Second, you can pin it. On iOS, tap Share then Add to Home Screen; on Android, tap the browser menu then Install app or Add to Home screen. That gives you an icon that opens X full-screen with your session already live, which is most of what the native app was doing for you. Our guide to using X in a web browser covers what the web version can and cannot do.

#When the app refuses you and the browser does not

Give this one its own section, because the error message actively sends you the wrong way.

Android users open the official X app, tap log in, and get told: "Please use X.com or official X apps to proceed with log in/sign up." They are already in the official app. Reports run from at least February 2026, when one user described being able to log in on a laptop while the phone app refused, through to late May and June, when another posted the full list of things that did not help: clearing storage and cache, uninstalling and reinstalling, restarting the phone, trying different login methods, and switching between mobile data and wifi. People trying to register a brand new account hit the same wall from the other direction, told on the web to finish signing up in the app and told in the app to go and use the web.

Nothing in that list is a credentials problem, which is the useful signal. When an app rejects a login that the browser accepts seconds later, the account is fine and the password is fine. What has failed is the check that proves to X's backend that the request came from a client it recognises, and you cannot fix that from the handset.

So do this instead:

1. Open x.com in the phone's browser and sign in there. For most people affected, this just works, and it is the whole workaround.
2. Add x.com to your home screen using the steps above. You get an icon and a full-screen session, so day to day you barely notice the app is missing.
3. Do not keep retrying in the app. Repeated failed attempts can earn you a rate-lock, and then you have an app problem and a temporary login block.
4. Update the app when a new version lands, then try once. If it still refuses, go back to the browser and get on with your day.

Worth knowing even if it never happens to you, because it is the general rule for X sign-in: when one surface fails, change surface before you change your password. An account that signs in anywhere is not broken.

#When your browser is the thing being blocked

Another failure people misdiagnose is "We've temporarily limited your login. Please try again later." Nearly every guide reads that as a rate-lock from too many password attempts. Often it is. But it also fires when nothing is wrong with your password at all, and two documented cases show why.

Extensions. A run of x.com login failures reported in Brave from mid-July 2026 looked like a browser bug, and turning Shields off changed nothing. The cause turned out to be an ad-blocking extension, AdGuard, interrupting the sign-in flow; the thread also resolved for people on Brave 1.93.137 (Brave Community, Jul 2026). The test is thirty seconds: open a private window, where extensions are off by default, and try there. If it works, it is an extension, and you re-enable them one at a time until it breaks again.

Your browser's identity. In June 2026 a user of Thorium, a Chromium fork, reported the same "temporarily limited" block on every attempt while the same account on the same machine signed in normally in stock Chromium (Thorium issue #1216). The same person had their account suspended repeatedly for "inauthentic behaviour" and reinstated on appeal. A fork that ships a non-standard user agent looks unusual to automated anti-abuse checks, and unusual is what those checks are built to act on.

The practical rule: X's login is doing fingerprinting, not just password checking. Anything that makes your browser look atypical, a rare fork, a heavily modified user agent, an aggressive privacy extension, a VPN exit that thousands of accounts share, raises the odds of a challenge you did not earn. That does not make privacy tooling wrong. It does mean that when a login is blocked and the password is definitely right, the browser is the first variable to change, not the last.

Work through it in this order: private window, then a different mainstream browser, then the same browser with wifi off on mobile data. Whichever one succeeds tells you where the problem lives.

#Where you log in changes what happens

Two rules now decide whether an X login works before your password is even checked, and both depend on where you are.

Australia. Since 10 December 2025, age-restricted platforms have had to take reasonable steps to stop Australians under 16 from "creating or keeping an account" (OAIC). X sits on that restricted list next to Facebook, Instagram, TikTok, Snapchat, YouTube, Reddit and Twitch, and the obligation covered accounts that already existed, not just new signups (Legal Aid WA). So if a teenager's login stopped working around then and password resets change nothing, this is the reason, and no browser fix touches it. The account was deactivated by policy.

UK, Ireland and the EU. Here the check lands after sign-in rather than at the door. X runs age assurance to work out whether an account belongs to someone over 18 and can therefore see sensitive media. Its own age assurance page lists the signals it reads: age you declared previously, an ID verification you already completed, legacy verified status, and whether the account was created in 2012 or earlier. Accounts estimated as under 18 get defaulted into restricted settings, and X says you can challenge a wrong estimate through X Support. Your login still works. What you can see changes.

Canada, and most of the rest of the world. There is no Canadian X login, no ca.x.com, and no age check standing between you and your timeline: Canada has not passed the kind of platform age-verification duty the UK, Ireland, the EU and Australia now have, so the answer to "X login Canada" is the same x.com everyone else uses. If you searched that because something specific broke for you, the cause is in the sections above, not your country.

Everywhere else. If x.com will not load at all, that is the network, not the account. Test it on mobile data with wifi off. A page that never renders points at a DNS filter, a school or corporate network, a VPN exit X rate-limits, or a country-level block, and none of those are fixed by resetting a password.

#The security-key change that still locks people out

Here is the part most login guides skip. In late 2025, X finished moving the platform off its original domain onto x.com. Passwords and authenticator-app codes were unaffected, but passkeys and hardware security keys are cryptographically bound to the domain they were created on, so keys enrolled under the old domain stopped being valid on x.com.

X told every account using a security key as its 2FA method to re-enroll the key, or enroll a new one, by November 10, 2025, or lose access until they did (Engadget, Oct 2025; the notice came from @Safety on X). Accounts that missed the date got locked until the owner re-enrolled a key, switched to another 2FA method such as an authenticator app, or turned 2FA off.

If you are reading this because you are suddenly locked out and you use a YubiKey or a passkey, that is very likely the cause. The fix: recover access through a backup method, then go to Settings and privacy, Security and account access, Security, Two-factor authentication, and re-enroll the key under x.com. If you only ever used a password or an authenticator app, none of this applies to you.

#When the X login fails: the real fixes

Most sign-in failures on the web are dull and fixable. X's own log-in help page lists the same handful of causes we see over and over:

If the password itself stopped working and you did not change it, treat that as an X account hacked situation and secure your email before you reset anything. A weak connection can also interrupt the login handshake, so if nothing else is wrong, restart your router and let the connection settle. If you are genuinely stuck after all of this, X's account-access recovery form is the escalation path.

Settings links worth bookmarking

Once you are actually in, three addresses save a lot of menu-hunting. They only resolve while signed in.

Forgot which email or username the account uses

Losing the email address does not lock you out. Your @username works as the identifier, and so does the phone number on the account. If all three have slipped your mind, the Forgot password flow accepts any one of them and shows you the email it is sending to, partially masked, which is usually enough to jog the memory. If that masked address is one you no longer control, you are in account-access recovery rather than a password reset, and X will ask you to prove ownership another way.

#When you are stuck in a verification loop

One failure deserves separating from the rest, because everything in the table above does nothing for it. X accepts your password, then asks you to confirm your identity. You enter a phone number or an email, the code never lands or gets refused, and the same prompt comes back. Round and round.

The loop is usually X's side rather than yours. When the domain migration landed in November 2025, people reported exactly it: an endless verification loop while trying to confirm identity by phone, email or authenticator app, alongside pop-ups demanding a YubiKey re-enrollment (Yahoo Tech, 12 November 2025). X never acknowledged the outage publicly.

Work through it in this order:

1. Use a saved backup code. The codes you stored when you turned on two-factor authentication sidestep the whole problem, because nothing has to be delivered to you.
2. Change the delivery channel. SMS failing? Use the authenticator app. Authenticator failing? Set your device clock to automatic, since a drifting clock invalidates every code it generates.
3. Change one variable at a time. Same account, different network: phone on mobile data, wifi off. Same network, different surface: the app if you were in a browser, the browser if you were in the app. Get in anywhere and the account is fine, which means the problem is local.
4. Stop retrying. Hammering the loop stacks a rate-lock on top of the original fault, and now you have two problems.
5. Check whether it is everyone. A loop that thousands hit at the same minute is an outage, and the only fix for an outage is waiting.

#Signed in to more than one account

Most people never find the switcher, then complain about signing in and out all day. On desktop web, your profile picture and @handle sit at the bottom left of the sidebar. Click the three dots next to them and choose Add an existing account, sign in as normal, and both accounts stay live. Clicking the same spot switches between them without another password prompt.

That switcher holds several accounts at once but it is not unlimited, and X has capped simultaneous sign-ins for years. When it refuses to add another, you have two honest options: sign one account out, or run the extra accounts in a separate browser profile, since each profile keeps its own cookie jar and therefore its own set of sessions.

One caution worth more than the tip itself. Owning several accounts is normal, and running a work handle beside a personal one is fine. What draws enforcement is behaviour, not the count: posting the same content across accounts you control, or having them like, repost and reply to each other to inflate numbers, is platform manipulation under X's rules, and it can take all of them down together.

#Log out, and log out everywhere

Signing out of the browser you are holding is the profile menu, then Log out. The more useful one is the list of every other session, at Settings and privacy, Your account, Security and account access, Security, Apps and sessions, Sessions. That screen shows every device holding a live session with its browser, last active time and rough location, and Log out of all other sessions at the top kills all of them except the one you are in. The same screen lists third-party apps holding access tokens, and revoking one there cuts it off instantly (X Help on apps and log in sessions).

Run it after a shared computer, after you retire a phone, and immediately if a session looks wrong. Full walkthrough: how to log out of X.

#Web vs the app: what you actually get

You do not lose anything meaningful by staying in the browser. The X web experience covers the full timeline, posting and threads, replies, DMs, search, lists, bookmarks, analytics and account settings. For a lot of people the web is the better home base: a real browser tab is easier to manage, bookmark and keep signed in than the mobile app, and it is the surface most third-party tools attach to.

If you run a Professional or business profile, the web is where the dashboard lives. We cover that setup in the X business account guide.

#Keep your session safe (and skip the "special browser" upsell)

Search "X login" and the top results are mostly antidetect or multi-account browser vendors pitching a tool to log in "safely" or run many accounts at once. You do not need any of that to sign in to your own account, and there is a real cost to reaching for one.

The reason is simple: your logged-in session cookie is effectively your account. Anything that stores, syncs or proxies that cookie, whether a cloud tool, a shared "multi-account" browser or a random extension, can act as you, and if that service is breached your session goes with it. A few habits keep the risk down:

• Log in only at x.com, never through a link you did not initiate.
• Turn on 2FA, keep an authenticator app as your portable second factor, and save backup codes offline.
• Be skeptical of extensions and "login helpers" that ask for broad permissions on x.com.
• Check Apps and sessions every few months and revoke what you no longer use.
• Prefer a browser you own and control over any cloud service that holds your session.

This is also the honest line on automation. If you use a tool to help post or reply, the setup with the smallest detection surface is one that works from your own logged-in browser on your own machine, where the session cookie never leaves your device. That is a smaller footprint than a cloud tool posting from a shared IP pool, though no browser-route automation is sanctioned by X's rules. We lay out that trade-off in local vs cloud X automation, and X-Autopilot is built on exactly that model: it drives X from the same browser session you just signed into, on your Mac, rather than asking you to hand your login to the cloud.

#Bottom line

The X login is the easy part: x.com, your identifier, your password, clear 2FA, done, in any browser without an app. Almost everything that goes wrong around it has one habit in common, which is that people change their password when they should change their surface. If the Android app tells you to use x.com, use x.com. If the login is "temporarily limited" on the very first attempt, open a private window before you wait an hour. If a passkey stopped working, that is the 2025 domain migration, not a forgotten password. If a teenager's account went dark in Australia in December, no browser fix reaches it. Log in at x.com, keep 2FA on, know where the Sessions screen is, and do not hand your session to a tool you do not control. If growing the account is the next problem, start with how to get followers on X.