Table of Contents
LinkedIn is the world’s largest professional network, and that makes it one of the most valuable targets for attackers. A compromised LinkedIn account gives criminals access to your professional identity, your connections’ contact information, and a trusted platform for launching phishing attacks disguised as job offers, business proposals, or recruitment outreach. LinkedIn’s 2012 breach eventually leaked about 117 million email and password pairs, and the platform remains a top target for credential stuffing and social engineering. This guide, part of our Password Manager Guides & Tutorials series, walks you through changing your LinkedIn password on desktop and mobile, turning on two-factor authentication, and hardening your account against the threats that specifically target professional networks.
When and Why to Change Your LinkedIn Password
LinkedIn accounts are prime targets for several reasons that make password hygiene especially important:
- Professional phishing. Attackers use compromised LinkedIn accounts to send convincing job offers, partnership proposals, and recruitment messages. Because LinkedIn is inherently a platform for connecting with strangers professionally, recipients are less suspicious of messages from unknown accounts than they would be on other platforms.
- Business email compromise. A compromised LinkedIn account reveals your employer, title, colleagues, and business relationships – exactly the information needed to craft targeted phishing emails to your coworkers or clients.
- Credential stuffing from past breaches. LinkedIn’s 2012 breach and later data scraping incidents mean that old LinkedIn credentials are widely available in breach databases. If you have not changed your password since then, or if you reused that password elsewhere, you are exposed.
- Recruitment and job scams. Fake recruiters using stolen accounts lure victims with lucrative job postings, then collect personal information (Social Security numbers, banking details) under the guise of “onboarding.”
Change your LinkedIn password immediately if you notice suspicious activity, receive a breach notification, suspect password reuse with another compromised service, or have not updated it in over a year.
Before You Start
Prepare before making the change:
- Your current LinkedIn password. Required for the standard password change process. If you have forgotten it, see the reset section below.
- Your password manager. Open PanicVault or your preferred manager to generate a strong replacement and save it immediately.
- Your recovery email and phone number. Verify these are current in your LinkedIn settings. Go to Settings & Privacy → Sign in & security → Email addresses and Phone numbers to confirm.
- A decision about other sessions. LinkedIn lets you sign out every other device when you change your password. If you choose that, expect to sign in again on your phone, tablet, and any other device where you use LinkedIn.
How to Change Your LinkedIn Password on Desktop (Web)
Step 1: Go to LinkedIn settings
Open linkedin.com in your browser and sign in. Click the Me icon (your photo) in the top navigation bar, then select Settings & Privacy from the dropdown menu.
Step 2: Navigate to Sign in & security
In the left sidebar of the settings page, click Sign in & security. This section manages your password, two-factor authentication, passkeys, and active sessions.
Step 3: Click Change password
Find the Change password option and click it. LinkedIn may prompt you to verify your identity before proceeding.
Step 4: Enter your current and new password
Fill in the form:
- Current password: Your existing LinkedIn password.
- New password: A randomly generated password from your password manager. Use at least 20 characters with uppercase, lowercase, numbers, and symbols.
- Retype new password: Confirm the new password.
Below the fields, LinkedIn offers Require all devices to sign in with new password. Select it if there is any chance someone else has been in your account: it signs out every other session.
Step 5: Save the change
Click Save password. LinkedIn confirms the update.
Step 6: Update your password manager
Open PanicVault or your password manager and update the LinkedIn entry with your new password. Verify the URL field contains linkedin.com so AutoFill works correctly on LinkedIn sign-in pages.
How to Change Your LinkedIn Password on Mobile App
Step 1: Open LinkedIn app settings
Launch the LinkedIn app on your iPhone or Android device. Tap your profile picture, then tap Settings & Privacy.
Step 2: Navigate to Sign in & security
Tap Sign in & security.
Step 3: Tap Change password
Tap Change password (on Android, you may need to tap Change password a second time). The app may ask you to verify your identity.
Step 4: Enter your passwords
Enter your current password, then enter and confirm your new password. Generate the new password with PanicVault’s password generator on your phone and paste it into both fields. To sign out your other devices, set Require all devices to sign in with new password to Yes.
Step 5: Save and sync
Tap Save password. Update the LinkedIn entry in your mobile password manager. If your password manager syncs via cloud storage, the new credential reaches your other devices the next time the vault syncs.
What Makes a Strong LinkedIn Password
Given the high value of LinkedIn accounts for professional phishing and business email compromise, your replacement password should be exceptionally strong:
- At least 20 characters. LinkedIn supports long passwords. Since your password manager autofills it, there is no convenience cost to length.
- Randomly generated. Use your password manager’s built-in generator. Do not create passwords based on patterns, dictionary words, or personal information. Our strong password guide explains why human-created passwords are predictable.
- Unique to LinkedIn. Never use the same password on LinkedIn and any other service. If your LinkedIn password matches your Gmail or Microsoft password, a single breach compromises both accounts.
- Free of professional keywords. Do not include your company name, job title, industry terms, or any information visible on your LinkedIn profile. Attackers try these first in targeted attacks.
Store It in a Password Manager
Properly storing your new LinkedIn password is essential for both security and convenience:
- Open PanicVault or your preferred password manager and locate your LinkedIn entry.
- Replace the old password with the new one. If you used the in-app generator, the new password may already be saved.
- Verify the URL is set to
https://www.linkedin.comso AutoFill activates on LinkedIn sign-in pages. - Add the two-factor secret to the same entry when you turn on 2FA (see below).
- Add a date note for your records, noting when the password was last changed. This is valuable during password audits.
- Confirm sync across devices. Open your password manager on another device and verify the updated LinkedIn entry is there.
Not using a password manager yet? Read our first-time setup guide to get started. A password manager is the single most impactful security tool you can adopt.
What to Do If You Forgot Your LinkedIn Password
If you cannot remember your current LinkedIn password:
- Go to the LinkedIn sign-in page at linkedin.com or open the LinkedIn app.
- Click or tap “Forgot password?” below the sign-in form.
- Enter your email address or phone number. LinkedIn uses this to locate your account.
- Enter the verification code. LinkedIn sends a code (not a link) to that email address, or by text or voice call to that phone number. Enter it and select Submit before it expires. If two-factor authentication is on, LinkedIn may also ask for your 2FA code.
- Create a new password. Use your password manager’s generator to create a strong, random password of at least 20 characters.
- Save it immediately. Store the new password in PanicVault or your preferred password manager before doing anything else.
- Turn on two-factor authentication once you are back in your account (see below).
If you no longer have access to the email address or phone number on your account, select Can’t access this email? (or Don’t have access to any of these?). LinkedIn asks for a new email address and a photo of a government-issued ID before it restores access. Keep your recovery information current to avoid this scenario.
Turn On Two-Factor Authentication
LinkedIn now calls this setting two-factor authentication (older help pages and guides say “two-step verification”). It offers two methods:
- Authenticator App – the method LinkedIn recommends. Any standard TOTP app works, including a password manager with TOTP support. Codes are generated on your device every 30 seconds, so they cannot be stolen through SIM swapping or SMS interception.
- Phone Number (SMS) – a six-digit code by text message. Better than no 2FA, but it is the weaker option.
When you are already signed in to the LinkedIn app, LinkedIn may show a sign-in prompt on your phone instead of asking for a code. You cannot pick that prompt as your method; it comes on top of the one you set up. LinkedIn’s help pages do not list hardware security keys as a two-factor option. LinkedIn does support passkeys for signing in (Settings & Privacy > Sign in & security > Passkeys, up to five), although the option is not shown on every device yet.
On the web
- Click the Me icon, then Settings & Privacy.
- Click Sign in & security, then Two-factor authentication.
- Click Turn on, then Set up.
- Choose Authenticator App and click Continue.
- LinkedIn shows a QR code and a text key. Scan the QR code with your authenticator, or enter the key manually.
- Enter the six-digit code your authenticator shows, and confirm.
In the iPhone or Android app
- Tap your profile picture, then Settings & Privacy.
- Tap Sign in & security > Two-factor authentication.
- Turn the setting on and tap Set up, then choose Authenticator App.
- Because your authenticator is probably on the same phone, copy the text key instead of scanning, add it to your authenticator or password manager, and enter the six-digit code back in LinkedIn.
Storing the code in PanicVault
PanicVault, a KeePass-compatible password manager for iPhone, iPad, and Mac, can be your LinkedIn authenticator. Edit your LinkedIn entry, go to the One-Time Password section, and either tap Scan QR Code (on iPhone and iPad) or paste LinkedIn’s text key. A live code appears with a countdown; tap it to copy. The secret is saved as a standard otpauth:// URI inside your encrypted .kdbx file, so the same entry also works in KeePassXC or any other KeePass app that reads that format.
If you lose access to your authenticator
LinkedIn’s help center does not describe backup or recovery codes for two-factor authentication, so plan ahead:
- Back up the secret itself. LinkedIn’s help assumes your authenticator lives on one phone, and tells you to turn 2FA off and set it up again from a signed-in session before you switch phones. If the secret is stored in your password manager vault, it moves to a new phone with the vault and nothing needs to be redone. See how to back up 2FA.
- Use a session you are still signed in to. If LinkedIn is still open on another device, you can turn 2FA off there and set it up again.
- Otherwise, verify your identity. At the two-factor prompt, choose verify your identity and upload a photo of a government-issued ID (LinkedIn uses the verification provider Persona, which may also ask for a selfie). Keep your phone number and email current so the rest of the recovery goes smoothly.
Harden Your LinkedIn Account
LinkedIn accounts warrant additional security measures beyond a strong password and 2FA:
- Review active sessions. Under Sign in & security → Where you’re signed in, review every active session. Sign out of any you do not recognize, or choose Sign out of all these sessions.
- Check your email addresses and phone numbers. Verify that only yours are listed. An attacker who has added their own email can use it to reset your password later.
- Review connected apps. Under Data privacy → Other applications → Permitted Services, remove any third-party apps you no longer use.
- Limit what strangers can see. In Settings & Privacy → Visibility, control who can see your connections and email address. Less public detail makes spear-phishing your network harder.
- Be cautious with connection requests. Fake profiles are a primary vector for LinkedIn-based attacks. Verify connection requests from people you do not know, especially if they claim to be recruiters or executives.
