Best practices for protecting your HeyGen account: strong passwords, two-factor authentication (2FA), and SAML SSO for Business and Enterprise teams.
A common cause of account compromise is a password leaked from another website and reused on HeyGen. The steps below help keep your account, avatars, and videos secure.
How do I use a strong, unique password?
Don't reuse passwords. Use a password for HeyGen that you don't use on any other website.
Make it secure. Use at least 12 characters with a mix of uppercase and lowercase letters, numbers, and special characters (such as ! @ # $).
Use a password manager to generate and store your passwords.
Don't share your login. Invite teammates to your workspace instead. See Collaboration and Access Control with Workspaces to learn how.
đď¸ Important: Your email account is used to reset your HeyGen password, so make sure it is also protected with a strong password and 2FA. If you sign in with Google or Apple, turn on 2FA with Google or Apple directly, since you don't use a HeyGen password.
How do I turn on two-factor authentication (2FA)?
Two-factor authentication adds a second step to sign-in: after entering your password, you enter a code from an authenticator app on your phone. Even if your password is stolen, no one can access your account without your phone.
Click the box with your initial in the lower-left corner of HeyGen.
Select Settings.
Under the Account tab, turn on the 2-factor authentication toggle.
Click Send code, enter the verification code sent to your email, then click Continue. This confirms it's really you.
Scan the QR code with an authenticator app. We recommend Google Authenticator.
Enter the verification code shown in the authenticator app, then click Verify to finish setup.
For more account settings, see How to manage your HeyGen account settings.
How do I set up SAML SSO for my team? (Business and Enterprise)
SAML SSO is available on Business and Enterprise plans. It lets your team sign in to HeyGen with your company identity provider, so access is managed in one place. Follow the guide for your provider:
Enterprise admins can also choose which sign-in methods are allowed for their workspace (Google, Apple, Magic Link, Email + Password, and SAML SSO) from the Security tab in workspace settings. See Advanced Enterprise Settings for details.
Related Articles
Last Updated: October 27, 2026