Final Fantasy XIV: How to Secure Your Account (Password and OTP Guide)

Password reuse carries risk across services. An email address and password exposed on another website can be tested against a Square Enix account through an automated attack called credential stuffing. For Final Fantasy XIV players, the clean route is to replace any reused Square Enix password, enable one-time-password protection through account management, and preserve a way to recover access if the authenticator phone is lost.

Start from a saved official Square Enix bookmark or an official address you enter yourself. If a security warning arrives by email, open account management separately rather than following its login link. A convincing warning can itself be the route to a fake login page.

Table of Contents (7)

Replace the password on the Square Enix account itself

Change the password belonging to the Square Enix account you use for Final Fantasy XIV. Changing only your PlayStation Network password leaves the Square Enix password untouched; changing only your email password does the same.

Open the password-change controls in Square Enix account management and generate a new password with a password manager. Use a long, random password within the form’s accepted length and character rules. Those rules should determine the generator settings rather than an arbitrary length copied from an older guide.

• Replace reused passwords completely. Adding a number, changing the year or appending a symbol preserves much of the original pattern.
• Avoid predictable personal details. Birthdates, repeated characters and simple number sequences remain weak choices even if you have never used that exact password elsewhere.
• Save the new Square Enix password in an encrypted password manager. Keep it out of screenshots, plain-text notes and chat messages.

If you have forgotten the current password, begin recovery through Square Enix’s official account page. Check that the password-manager entry is updated after the reset so it does not keep supplying the old password.

A unique password breaks the connection between a leak elsewhere and your Final Fantasy XIV login. It still needs protection against phishing, which can capture the new password as you enter it.

Enable one-time passwords through Square Enix account management

Square Enix’s one-time-password system adds a changing authentication code to supported account logins. Someone who obtains your normal password would also need the additional authentication factor to complete a protected login.

Begin enrollment inside the official account-management service. Let its current instructions determine the authenticator and registration method. On Android and iOS, avoid choosing an app solely because its store listing uses Square Enix branding. Follow the app guidance or listing supplied by Square Enix’s setup flow, and check that the app and developer match those instructions.

Keep the account-management page open while you complete enrollment on the phone. If the setup presents a QR code, scan that code from your own account-management session. If it provides a manual setup key instead, enter it only into the authenticator specified by the official instructions.

The QR code and setup key are authentication secrets. Anyone who obtains the underlying secret may be able to generate the same codes. Do not send it to another player, paste it into a support conversation or leave an enrollment screenshot in cloud photo storage.

Complete the activation check requested by the enrollment page, including entering a generated code where instructed. An authenticator displaying numbers does not, by itself, mean the Square Enix account has finished registering it.

Save recovery information before relying on the phone

Before closing enrollment, record any emergency removal code, backup code or recovery instructions Square Enix presents. Keep that information somewhere you can reach without unlocking the enrolled phone. An offline copy stored securely avoids making the same device both your authenticator and your only recovery route.

Then perform a fresh login on a trusted device. Check that the new password works and that the current one-time password is accepted when requested. Complete this test before deleting old credentials or wiping a phone.

When replacing an Android phone or iPhone, follow Square Enix’s current transfer or re-enrollment instructions while the old device remains accessible. Do not assume that copying the app to a new phone also transfers a working Square Enix token. Test the replacement before factory-resetting the original.

Fix rejected codes without making recovery harder

Time-based authenticators depend on an accurate device clock. Set the Android or iOS phone’s date and time to automatic network time, then use a fresh code rather than one close to changing.

• Check the authenticator entry. If the app contains several accounts, use the entry registered to the Square Enix account you are signing into.
• Check enrollment completion. If the first login fails immediately after setup, review whether account management finished activating one-time-password protection.
• Preserve the existing token. Deleting the authenticator entry or reinstalling the app can remove access to the codes without removing the requirement from the account.
• Use official recovery when the phone is unavailable. Follow the saved removal or recovery procedure, or reach Square Enix support through its official portal.

Never give a current one-time password or authenticator setup secret to someone claiming to help recover the account. Enter codes only into the official authentication or enrollment flow you opened yourself.

Protect the email and platform accounts around Final Fantasy XIV

The email address registered to Square Enix deserves its own unique password and multifactor authentication. Access to that inbox can expose password-reset messages and account-recovery correspondence, creating another route toward control of the Square Enix account.

For PlayStation 5 players, PlayStation Network and Square Enix authentication are separate security layers. Review both accounts, using different passwords for each. Enabling protection on one does not enable it on the other, and unlinking accounts should not be used as an improvised security fix because linking changes can affect game access.

On a shared PC, keep Square Enix credentials out of the shared browser and sign out of both the launcher and account-management website when finished. On a shared console, use separate user profiles and available device passcodes to limit access to an already authenticated session.

Review account activity if you suspect someone already got in

Check the registered email address, account details, purchase history and saved payment methods for changes you did not make. Where account management provides session or device controls, sign out unfamiliar sessions. A successful password change alone does not tell you whether existing sessions have ended.

Remove payment details you no longer need and report unauthorized transactions through the relevant store or payment provider. If login is restricted or account details have changed, use Square Enix’s official recovery route rather than repeatedly attempting resets through messages in your inbox.

The setup worth keeping

For Final Fantasy XIV, the strongest practical setup is a unique Square Enix password, working one-time-password authentication and a separately protected recovery email. Finish with a successful fresh login and recovery information stored away from the authenticator phone. That gives you protection against reused-password attacks without turning a lost handset into an avoidable lockout.