Some sites claim they can figure out someone’s Instagram password. How true is that? I saw my kid using another account, which I didn’t know about. Is there a way I can check his account? Please suggest only legal and ethical methods.
First: those sites that claim to “find” or “recover” someone’s Instagram password. They are completely fake, every single one. I have seen maybe a dozen of them over the years and the pattern is always identical. You type in a username, it shows a fake hacking animation, then it asks you to complete a survey or pay a small fee for the “result.” The result never comes. These are either ad revenue farms or outright phishing traps designed to steal your information in the process. Instagram does not expose password data to any third party, ever. There is no API for this, no backdoor, no workaround. It simply does not exist.
Second, and this is the part I actually want to discuss: finding out your kid has a secret account is genuinely unsettling. I get that. The instinct is to want to see what is in there. But what does it actually mean that the account exists? Is it about hiding something specific, or is it more about having a space that feels separate from family? Because those two things need pretty different responses.
A secret account for a 16-year-old is different from one for a 12-year-old. The platform, who they are talking to, what they are posting, and how old they are, all of it changes what the right move is.
So before jumping to tools: what do we actually know about the situation here? 
I Found Out My Kid Has a Secret Instagram Account and Here Is What To Actually Do
Let me be direct about both parts of this question because I see a lot of vague answers around this topic.
Can You Legally Access Someone Else’s Instagram Password?
No. Full stop. There is no legal method to access another person’s Instagram account without their login credentials. This applies even to your own minor child’s account if you do not already have the password.
Here is why: under the Computer Fraud and Abuse Act in the US, unauthorized access to any computer account, including social media, is a federal offense. The UK has the Computer Misuse Act. Australia has the Criminal Code Act. Most countries have equivalent laws. “Someone else’s account” means exactly that. Your relationship to the person does not create a legal exception unless you are the account holder yourself.
The sites claiming to find passwords are scams. Do not enter any information into them. Some harvest your own credentials in the process.
What You Can Legally Do as a Parent
Option 1: Have a Direct Conversation
Ask your kid about the account directly. Yes, this feels confrontational. But it is also the only approach that addresses the actual issue rather than just the symptom.
Option 2: Use Instagram’s Family Center
Instagram has a built-in supervision tool called Family Center. Here is how to set it up:
- Open Instagram on your phone
- Go to your profile, tap the three lines, then Settings
- Tap “Supervision” or search for Family Center
- Send a supervision invite to your child’s account
- Your child has to accept the invite on their device
Once connected, you can see who they follow, who follows them, time spent on the app, and set daily time limits. You cannot read messages but you get meaningful activity visibility.
Option 3: Use a Parental Monitoring App
Apps like Xnspy install on the child’s device and give you broader visibility than Instagram’s own tools. You can see app activity, screen time, and with some plans, social media content. The important thing: install it on a device you own, with your child knowing it is there.
Option 4: Set Device-Level Rules
iPhone: Settings > Screen Time > Content and Privacy Restrictions. You can require approval before new apps are downloaded, which prevents new accounts from being set up without your knowledge going forward.
Android: Google Family Link does the same. You get app approval controls and activity reports.
The Ethical Line
The ethical approach is transparency. Your child knowing they are monitored is not a weakness in the system, it is the whole point. Covert monitoring of a minor in a device you own and pay for sits in a gray area legally. Monitoring with disclosure is clear. 
Jumping in on what @Auralyte raised because yeah, the WHY of the secret account matters a lot.
I had a situation with my younger brother, not a parent-child thing but similar energy. He had a second Instagram that none of us knew about for about a year. When it finally came out it wasn’t anything dangerous, it was basically just a place where he posted stuff he thought the family would judge him for, like music he was into and opinions he didn’t want to argue about at dinner.
That’s actually pretty common with teens. The “finsta” or secondary account thing is often less about hiding genuinely dangerous stuff and more about having a space that isn’t watched by parents, extended family, teachers, whoever they’ve added on their main account.
That doesn’t mean you ignore it, obviously. But it changes how you approach the conversation. Going in with “I need access to that account” vs “I noticed you have another account, what’s that about?” will get very different responses and very different outcomes. The second one actually gets you information. The first one just closes the door. 
To answer the password question factually: no tool exists that can retrieve another person’s Instagram password legally. Here is what actually happens technically.
Instagram stores passwords as salted hashes, not plain text. Even Instagram’s own engineers cannot see your actual password. When you log in, Instagram hashes what you typed and compares it to the stored hash. The original password is not retrievable by anyone, including Instagram. So the concept of “finding” someone’s password is technically wrong as a premise.
Password reset only works if you control the email address or phone number tied to the account. If you do not control those, the reset path is not available to you.
For parents: the practical options are Instagram’s Family Center supervision tools, device-level parental controls through Screen Time or Google Family Link, or a parental monitoring app installed on a device you own. None of these give you the password. All of them give you something more useful than a password anyway, which is visibility into what is actually happening. 
Here is something worth sitting with: if your kid felt like they needed a whole separate account to have a private space online, what does that tell you about how they experience being on social media with you in the picture?
I’m not saying this to make anyone feel bad. I’m genuinely asking because I think parents sometimes chase the account access when the more useful question is what made the second account feel necessary in the first place.
There’s a difference between a kid hiding something dangerous, like contact with strangers, inappropriate content, bullying situations, and a kid just wanting a corner of the internet that doesn’t feel observed. Both are worth knowing about. But they’re not the same thing and they don’t need the same response.
Auralyte asked earlier what we actually know about the situation. I want to take that further: what do you think your kid’s answer would be if you asked them directly, without making it a confrontation? Because I’d bet most parents have a pretty good instinct about whether this is a safety concern or a privacy-assertion thing. That instinct is worth trusting before going full monitoring mode. 
On passwords: I spent about three hours once going through those “Instagram password finder” sites out of pure morbid curiosity. Not one of them delivered anything. Most hit you with a survey wall before “unlocking” the result. A couple asked me to download something. One redirected to a page asking for my own Instagram login to “verify” me. They’re traps. Anyone going to those sites looking for a real answer is going to come away with either nothing or less than they started with.
That said, Instagram Family Center is genuinely underused by parents. You can see followers, following, time spent, and set limits without ever needing a password. It’s not perfect but it covers a lot. 
OK I want to push back slightly on some of the replies here, not on the legal stuff, that’s all accurate, but on the “just have a conversation” framing.
That advice is correct in theory. In practice, when a parent discovers a secret account, the conversation rarely goes smoothly on the first try. The kid gets defensive, the parent gets anxious, and it either becomes a fight or the kid shuts down entirely. So “talk to them” is true but it undersells how hard that conversation actually is to execute.
On the other side, I’d argue that jumping straight to monitoring tools without the conversation is also a problem, not just ethically but practically. If your kid finds out you installed something without telling them, you lose the ability to use the tool AND you lose their trust, which is the one thing that actually keeps them safer online long term.
So my position: both things have to happen. The conversation first, even if it’s awkward and imperfect. The monitoring setup second, with the kid knowing about it. The conversation sets the context for the tool. The tool provides the ongoing visibility that one conversation cannot.
Neither alone gets you where you actually want to be, which is a kid who is safe and a relationship that stays intact. 
Brain dumping some options here for parents in this situation because I think it helps to see all the paths laid out:
Option A: Direct conversation first, no tools. High trust, lower visibility. Best outcome if the kid is honest. Worst outcome if they’re not.
Option B: Instagram Family Center setup with the kid’s knowledge. Requires them to accept the supervision invite. Free, built into the app. Gives follower info and time data but no message access.
Option C: Device Screen Time controls (iOS) or Family Link (Android). Prevents new apps without approval going forward. Does not recover info about the existing account but stops future hidden setups.
Option D: Parental monitoring app on a device the parent owns, disclosed to the child. Broader visibility including social media activity depending on the app. Xnspy fits here, it shows app usage and can surface Instagram activity, and it works on the consent-first model.
Option E: Ask for access directly. “Can I see your account?” Some kids say yes, especially if the relationship is solid. You’d be surprised.
Option F: Follow the account from your own Instagram if you can find it. Public accounts are public. Not all secondary accounts are private.
None of these are mutually exclusive. Most families end up combining a few. 
Something TriviaNext mentioned is worth expanding: if the secondary account is public, you can literally just find it and follow it. A lot of parents overlook this because they’re thinking about it as a hacking problem when it might just be a search problem.
Search their name, known nicknames, school name, interests, whatever they tend to use as usernames. If the account is public you’ll see the posts. If it’s private you can request to follow and see if they accept.
This is completely legal, it’s just using Instagram the way it was designed. No tools needed, no gray areas, no tech skills required.
If you find it and it’s private, that’s actually useful information too. A kid who made their secondary account private knows they don’t want certain people seeing it. The conversation after that has clearer context. 
Quick breakdown of the ethical guidelines that should frame any of this:
Consent matters regardless of age. Minors have privacy rights. The legal and ethical standard for monitoring a minor’s device is disclosure, not secrecy.
Device ownership creates some latitude but not unlimited access. You own the phone, you can set rules about it. You do not automatically own the content of every account created on it.
The goal matters. Monitoring for safety (online predators, bullying, self-harm content) is different from monitoring out of general curiosity or because you’re hurt they kept something from you. Be clear with yourself about which one this is.
Age is relevant. A 10-year-old’s Instagram activity and a 16-year-old’s are genuinely different situations from a parenting standpoint.
Transparency protects everyone. A kid who knows the rules is more likely to follow them. A monitoring setup they don’t know about is one discovery away from a major trust breakdown.
Tools are a last resort for safety concerns, not a first response to any secret. The conversation should come first. If the conversation reveals a real safety issue, then tools are appropriate. If it reveals a kid who just wanted some privacy, tools may actually be the wrong move. 
TL;DR: You cannot legally access someone else’s Instagram password. Those finder sites are scams. For your kid’s secret account, use Instagram Family Center, device parental controls, or a monitoring app like Xnspy installed with the kid’s knowledge. Have the conversation first.
Longer version:
The password question: Instagram uses one-way encryption (hashing) for passwords. Nobody, not you, not Instagram support, not any website, can retrieve the actual password. Any site claiming to do this is either faking the result or harvesting your data as you try. They make money through ad impressions on the fake loading screens and through the survey walls. Some go further and try to get your own login details under the guise of “verifying” you. Avoid them entirely.
The secret account question: This is solvable through legitimate means. Instagram’s own Family Center feature (under Settings > Supervision) lets you connect to your child’s account and see their follower and following lists, daily time spent, and set usage limits. It requires them to accept the connection, which is a feature, not a flaw. Having them accept it is the start of the transparency conversation.
If you want deeper visibility beyond what Family Center offers, an app like Xnspy gives you device-level monitoring including which apps are being used and for how long, installed on the device you own, with the child knowing about it.
Device controls like Screen Time on iPhone or Google Family Link on Android are worth setting up regardless. They let you approve new app downloads, which prevents new hidden accounts from appearing without your knowledge going forward.
The conversation still has to happen though. None of the tools replace it. 
Coming back to Astrynex’s point about the conversation being harder than it sounds, because yes, this is real.
One thing that helps: don’t make the secret account the opening line of the conversation. Start somewhere adjacent. Something like “I’ve been thinking about how we handle social media in this house and I want to check in about it” lands differently than “I know about your other account.”
The first framing keeps them from immediately going into defense mode. You can work toward the account from there. By the time it comes up, the conversation has some warmth to it instead of starting from confrontation.
Also, pick your moment. Not right after school, not right before bed, not when either of you is already stressed. A car ride actually works well for these conversations because there’s no eye contact and you’re both sort of captive in a neutral way. Parents who’ve done this stuff for a while tend to know the car ride trick. 
A few practical things anyone in this situation can do right now:
Step 1: Search for the account on Instagram first. Use the search bar, try their name, nicknames, school references. If it’s public, that’s your starting point.
Step 2: Set up Instagram Family Center. Go to Settings > Supervision on your Instagram. Send the invite. Have the conversation about why you’re doing it at the same time.
Step 3: Turn on Screen Time (iPhone) or Family Link (Android) if you haven’t already. Set up app approval so new accounts can’t be created without your OK.
Step 4: Have the actual conversation. Use DigiWave’s framing of coming in sideways rather than leading with “I know.” The goal is information and connection, not a confession.
Step 5: If safety is a genuine concern after the conversation, look at a monitoring app that gives you device-wide visibility. Xnspy is worth looking at for this, it covers app activity and usage patterns and it works on the transparent model.
And at every step: skip the password finder sites entirely. They waste your time and potentially expose your own data. There is nothing there. 