Should you turn on ChatGPT Advanced Account Security?

It is available for eligible personal ChatGPT accounts in supported regions. OpenAI says it is not available for ChatGPT Enterprise users, enterprise-managed accounts or accounts associated with an enterprise-managed domain.

Once enabled, the protection also applies to Codex when it is tied to the same login. That matters for anyone using the same account across ChatGPT and OpenAI’s coding-related tools.

What changes when you enable it

The biggest shift is away from password-based login. OpenAI says enrolled accounts use passkeys or FIDO-compatible physical security keys for sign-in. Help Net Security has described the setting as removing password-based sign-in from ChatGPT and Codex accounts and replacing it with passkeys or physical security keys.

Key changes include:

• Password sign-in is disabled. You sign in with passkeys or physical security keys instead.
• Email and SMS sign-in codes are disabled. You cannot rely on receiving a one-time code by email or text message.
• Email-based account recovery is disabled. The usual “recover by email” path is no longer available.
• Login notifications are enabled. These help you notice account activity more quickly.
• Sessions are shorter. You may need to sign in again more often.
• Conversations are not used to train OpenAI models while the setting is enabled. OpenAI states this in its help documentation for Advanced Account Security.

In short, the feature is designed to make stolen passwords and intercepted codes much less useful to an attacker. The trade-off is that you, the legitimate user, also have fewer easy recovery options if you lose your keys.

What you need before switching it on

OpenAI says you need at least two secure sign-in methods to enable Advanced Account Security, and at least one of them must work across multiple devices.

OpenAI lists examples such as:

• a passkey plus a physical security key
• two passkeys
• two physical security keys

You also receive a recovery key during setup, and OpenAI says you must store it safely. In practical terms, that means not keeping your only copy on the same phone or laptop you use to sign in. Think about what happens if your phone is stolen, your computer fails or passkey syncing does not work as expected.

The main risk: locking yourself out

The strongest reason to use Advanced Account Security is also the strongest reason to be careful with it: account recovery becomes intentionally harder.

OpenAI says that if you lose all sign-in methods and your recovery key, you may lose access to the account. The company’s support team can provide explanations and guidance, but OpenAI says support cannot restore access through normal email recovery, reset your password, turn off Advanced Account Security or add or remove sign-in methods to get you back in.

Even if you still have your recovery key, OpenAI says there is a 48-hour waiting period before the account is removed from Advanced Account Security. That delay could be painful if you lose a device while travelling, during a deadline or in the middle of a development project.

Who should consider enabling it

Advanced Account Security makes the most sense if the contents of your ChatGPT account would be valuable, sensitive or damaging if exposed.

You should consider it if you:

• use ChatGPT for confidential work documents, business planning, legal or financial drafts, client materials or internal notes
• store personal information or sensitive conversations in your account history
• use ChatGPT and Codex under the same login and want stronger protection for development-related work
• are a journalist, researcher, elected official, political dissident or another person more likely to face targeted digital attacks
• simply want the strongest available account protection and are willing to manage the extra responsibility

For these users, moving away from passwords and SMS-style codes can be a meaningful security upgrade.

Who should probably wait

This is not a setting to enable just because it sounds safer. It is safer only if you can manage the new login and recovery model.

You may want to wait if you:

• are not familiar with passkeys or physical security keys
• frequently change phones or computers
• are likely to misplace a hardware security key
• do not have a safe place to store a recovery key
• use ChatGPT only for light, low-risk tasks
• would be badly disrupted by a 48-hour recovery delay

For casual use, the extra friction may outweigh the benefit. The feature is powerful, but the cost of a mistake is higher than with ordinary password-based login.

If the setting does not appear

OpenAI says Advanced Account Security is offered to eligible personal ChatGPT accounts in supported regions, but not to ChatGPT Enterprise users, enterprise-managed accounts or accounts associated with an enterprise-managed domain. Availability for workspace-linked accounts may depend on the account configuration.

If you do not see Advanced Account Security in your ChatGPT Security settings, OpenAI says it is not currently available for that account.

OpenAI also says YubiKey purchase guidance may appear for users in the United States, the United Kingdom and the European Union. If you are elsewhere, do not assume the same purchase flow will be shown; check hardware-key compatibility and availability separately.

Before you enable it: a quick checklist

Before turning on Advanced Account Security, make sure you can answer yes to these five questions:

1. Do you have at least two secure sign-in methods?
   OpenAI requires at least two, and one must be usable across multiple devices.

2. Have you chosen where to store the recovery key?
   Losing the recovery key along with your sign-in methods can mean losing access to the account.

3. Can you sign in if your main phone or computer is unavailable?
   Test your fallback plan before you need it.

4. Can you tolerate a 48-hour recovery wait?
   OpenAI says using the recovery key still involves a 48-hour waiting period before the account is removed from Advanced Account Security.

5. Is your account eligible?
   Enterprise and enterprise-managed accounts are excluded, and workspace-linked accounts may depend on configuration.

Bottom line

Advanced Account Security is a strong option for people who keep sensitive information in ChatGPT or who face a higher risk of targeted account attacks. Replacing passwords with passkeys or hardware security keys can make an attacker’s job much harder.

But it is not a casual one-click upgrade. If you lose every sign-in method and your recovery key, OpenAI says normal support routes may not be able to get you back in.

The best rule of thumb: enable it if your ChatGPT account contains important or sensitive material and you are prepared to manage at least two secure sign-in methods plus a safely stored recovery key. If not, wait.