Help center

2FA, or Two-Factor Authentication, is a method of securing an account by requiring the use of two different factors to confirm the Client's identity. Instead of relying only on a password (one factor), 2FA adds an additional level of security.

Within XTB, there are three available authentication methods.

The first option is authentication via an SMS code sent to the Client’s phone number.
The second option is TOTP: Starting from July 14, 2025, XTB clients will also be able to use a new authentication method – Time-Based One-Time Password (TOTP). This method involves generating one-time codes in popular applications such as Google Authenticator, Microsoft Authenticator, or Apple Passwords, which are then used to verify the user’s identity. Its main advantages include enhanced security – as it is not dependent on the mobile network – as well as speed and convenience.
The third option is authentication via an code sent to the Client’s registered email address.

2FA can be launched from the xStation platform (browser version) and from the mobile application.

To launch 2FA in the mobile application, click the Profile icon in the upper left corner -> Security -> Two-Factor Authentication.

Select your preferred method:

SMS – enter your phone number and confirm the action using the code sent via SMS.

TOTP – install an authentication app (e.g., Google Authenticator or Microsoft Authenticator), then copy and paste the key into the app or scan the displayed QR code. The generated 6-digit code will be used to access your account.

To enable 2FA on the xStation platform, click the three lines in the upper right corner -> Settings -> Two-Factor Authentication:

How to add a device to the trusted devices list?

When you log into the XTB mobile app for the first time after setting up Two-Factor Authentication, you will be asked if you want to add this device to the trusted devices list. If you accept, you will not need to enter a verification code the next time you log in using this device.

Trusted Devices and Browsers List

You can verify trusted devices and browsers directly within the XTB mobile app. Open the XTB mobile app and tap the profile icon in the upper left corner. Then, go to the Security tab. Select Two-Factor Authentication (2FA). At the bottom of the screen, you will see a list of Trusted Devices and Browsers.

You can remove a trusted device or browser from the list at any time.

After removal, 2FA will be required on your next login from that device/browser.

Cookie name	Description
SERVERID
userBranchSymbol	Expiration date 1 day
test_cookie	Expiration date 1 hour
adobe_unique_id	Expiration date 364 days
__hssc	Expiration date 1 hour
SESSID	Expiration date 1 day
__cf_bm	Expiration date 1 hour
intercom-id-iojaybix	Expiration date 270 days
intercom-session-iojaybix	Expiration date 6 days
xtbCookiesSettings	Expiration date 364 days
TS5b68a4e1027
countryIsoCode
xtbLanguageSettings	Expiration date 364 days
userPreviousBranchSymbol	Expiration date 364 days
intercom-device-id-iojaybix	Expiration date 270 days
__cfruid
_cfuvid

Cookie name	Description
_gid	Expiration date 1 day
_gat_UA-98728395-1	Expiration date 1 hour
_gat_UA-121192761-1	Expiration date 1 hour
_gcl_au	Expiration date 89 days
_ga_CBPL72L2EC	Expiration date 729 days
_ga	Expiration date 729 days
__hstc	Expiration date 179 days
__hssrc
_vwo_uuid_v2	Expiration date 365 days
_ga_TC79BEJ20L	Expiration date 729 days
_vwo_uuid	Expiration date 365 days
_vwo_ds	Expiration date 29 days
_vwo_sn	Expiration date 1 hour
_vis_opt_s	Expiration date 99 days
_vis_opt_test_cookie
af_id	Expiration date 394 days
afUserId	Expiration date 730 days
AF_SYNC	Expiration date 6 days
AnalyticsSyncHistory	Expiration date 29 days

Cookie name	Description
MUID	Expiration date 389 days
_omappvp	Expiration date 3998 days
_omappvs	Expiration date 1 hour
_uetsid	Expiration date 1 day
_uetvid	Expiration date 389 days
_fbp	Expiration date 89 days
fr	Expiration date 89 days
_ttp	Expiration date 89 days
_tt_enable_cookie	Expiration date 89 days
hubspotutk	Expiration date 179 days
IDE	Expiration date 389 days
YSC
VISITOR_INFO1_LIVE	Expiration date 179 days
li_sugr	Expiration date 89 days
guest_id_marketing	Expiration date 729 days
guest_id_ads	Expiration date 729 days
guest_id	Expiration date 729 days
muc_ads	Expiration date 729 days
VISITOR_PRIVACY_METADATA	Expiration date 179 days
MSPTC	Expiration date 389 days

Cookie name	Description
bcookie	Expiration date 364 days
lidc	Expiration date 1 day
UserMatchHistory	Expiration date 29 days
bscookie	Expiration date 364 days
li_gc	Expiration date 179 days
personalization_id	Expiration date 729 days

How can we help you?

Two-Factor Authentication (2FA)

Related articles

How can I change my personal data?

Invite Friends

Changing the 2FA Authentication Method