What is Enhanced Protection?
Enhanced Protection is an advanced version of 2-step verification (2SV). It mandates phishing-resistant methods, such as device-bound passkeys or hardware security keys (e.g., Yubikeys), for sign-in and 2SV challenges.
By eliminating less secure methods like 6-digit one-time codes sent via email or authenticator apps, Enhanced Protection offers superior defense for your Roblox account.
Requirements
You must meet the following requirements before you can toggle on Enhanced Protection:
- At least one passkey: Passkeys will be the only acceptable methods for sign-in and 2SV challenges. (On Chrome and Android, you can also use a hardware security key as your passkey).
- A verified email: To receive critical account notifications and support identify verification in case of the need for account recovery.
- A secondary layer for identity verification: You must have either a verified phone number or backup codes.
Note: Passkeys, especially if they are external hardware security keys, can be lost or damaged. We require a verified email, a verified phone number, or backup codes, so you can pass two distinct challenges to securely regain access if you lose your passkeys.
How to Turn On
- Log into your Roblox account.
- Go to Settings.
- Select the Security tab.
- Find the Enhanced Protection section.
- Follow the on-screen prompts to complete eligibility requirements.
- Click Turn on.
How to Turn Off
- Log into your Roblox account.
- Go to Settings.
- Select the Security tab.
- Find the Enhanced Protection section.
- Click Turn off.
- Complete a security challenge using a passkey or a hardware security key.
What changes with Enhanced Protection?
When you enable Enhanced Protection, your account transitions to a higher security standard. This changes how your current login & 2SV methods work:
| Feature | Change Under Enhanced Protection |
| Passkeys | Passkeys become your primary method for signing into Roblox and solving 2SV challenges. |
| Hardware Security Keys |
Existing hardware security keys (like Yubikeys) remain active for sign-in and 2SV challenges on supported platforms. New hardware security keys can be registered as passkeys in Settings > Account Info > Login Methods. |
| Email One-Time Passcodes (OTP) | Traditional email OTP are disabled for 2SV challenges. If used for sign-in, you must still solve a passkey or hardware security key challenge. |
| Authenticator Apps Codes | 6-digit codes from apps (like Google Authenticator) are disabled for 2SV challenges. |
| Passwords | If passwords are used for sign-in, you must still solve a passkey or hardware security key challenge. |
Frequently Asked Questions
Can I turn Enhanced Protection off?
Yes. You can turn off Enhanced Protection at any time in your Security settings. However, we strongly recommend keeping it active to protect your account and business.
What if I lose my passkey?
If you lose access to your passkey, you will need to complete a multi-step recovery process to prove your ownership of the account. If you are unable to complete this process, you may be blocked from your account.
What if my device does not support passkeys (e.g., Xbox)?
Most mobile phones and browsers have built-in support. For devices that do not support passkeys (e.g., Xbox), we recommend that you use the Quick Login feature.
Who can use this?
Any Roblox user who wants the highest level of security can enroll as long as they meet the verification requirements (email, phone, passkey).