Signed up for Binance? Don't rush to deposit — set up and secure it the same day

Plenty of newcomers treat opening an account as a two-minute job: type an email, pick a password, deposit some money, start buying. The trouble is that "deposit the moment you're signed up" is the easiest way to walk onto a landmine — the account is still wide open, with no 2FA, no anti-phishing code and no withdrawal whitelist. Get phished or caught by a credential-stuffing attack at that point and the money goes in but can't come back out. This guide rolls two jobs into one: first get the account registered from scratch, then, on the same day, weld shut the doors that need welding. Work through it in order and you'll have both the account opened and the account hardened.

Three things to sort out before you sign up

Before you touch anything, think through three things — it saves you most of the hassle later.

1. Whether Binance is available where you live

Binance isn't available in the same way in every country, and some regions are restricted or have features switched off. Check first that you can use Binance legally where you live — if it's restricted, don't sign up, and definitely don't use a VPN, a made-up nationality or false details to slip past the limits. An account opened that way tends to get stuck at verification or withdrawal later, or flagged by risk controls, and it's not worth it. This one is a prerequisite: if it doesn't hold, don't go any further.

2. Make sure it's the real site and the real app

A lot of the time newcomers don't get burned after signing up — they walk through the wrong door at the moment of signing up. The top result in a search can be a copycat site that paid for the ad slot, with a domain and interface made to look nearly identical, so the login and password you type go straight to the scammers. The safe way is to reach the site through the official domain you've noted down yourself, or from a browser bookmark, and not click unknown links or search ads. Only download the app from your phone's official app store, checking the developer's name. For how to tell real from fake at a glance, see how to confirm you've installed the real Binance app.

3. Have an email or phone ready, and decide on the invite code

To register you'll need an email you can keep receiving mail at long-term or a phone number. The registration page may also offer an invite-code field; whether to use it is your choice. Our code is BN1899, but whether it is accepted, whether the page displays any benefit and who is eligible must be checked on the Binance page before you submit.

The six sign-up steps, start to finish

These six steps are the full flow, from nothing to a working account. Binance tweaks its interface wording now and then, so go by the official page in front of you for where the exact buttons are — but the big steps and their order stay roughly the same.

Step 1 · Open the real site

Reach the official Binance sign-up page using the approach above. Once you're there, glance at the domain in the browser's address bar to check it's right, and don't type anything into a page whose domain you haven't verified.

Step 2 · Register with email or phone, set a strong password

Choose email or phone to register and collect the verification code as prompted. When you set the password, remember the one thing that matters most: use this password only on Binance and nowhere else. Credential-stuffing attacks feed on reuse — an email-and-password pair leaked somewhere else gets tried against exchanges one by one. Letting a password manager generate a random string a dozen-plus characters long is the easiest route; if you'd rather not, at the very least make sure it's different from every other account you have. To get a sense of how well your password would hold up against brute force, try the password strength checker (it estimates locally and uploads nothing).

Step 3 · If you want to use it, enter the invite code and check the page

The sign-up page may show a “referral / invite code” field (sometimes under “more options”). If you choose to use it, enter BN1899 and check that the page accepts the code before submitting. Eligible new users may receive the fee rebate disclosed above; the actual rate, products, region, eligibility and term depend on the registration page and local terms. This site may earn a commission.

Step 4 · Finish identity verification (KYC)

Getting the account created is only the first step; to deposit, withdraw and trade normally, you also need to complete identity verification: enter your real name and ID details as prompted, upload photos of your ID, then do a face check. A few tips to pass on the first try — use your own genuine ID (don't borrow someone else's and don't use anything edited), shoot it somewhere well lit with all four corners in frame and no glare, and take off your hat and mask for the face check. Verification requirements and the ID types accepted vary by region, so go by Binance's current official page.

Verification is a step Binance has to run to meet its compliance obligations, and it's also the basis of your proof of identity later if you ever need to recover the account or file an appeal — so don't skip it to save a bit of hassle, because plenty of features simply won't work without it. Normally it clears quickly; when it bounces back it's usually one of a handful of reasons: a blurry or glared ID photo, details that don't match the ID, or a face check that's too dark. Reshoot, keep the spelling of your name exactly the same as on the ID, and it usually goes through. Review times follow Binance's own notice; if you're in a hurry, submit away from peak times.

Step 5 · Turn on security settings the same day

This is the step many people put off, and it's exactly the one you shouldn't — on sign-up day there isn't much in the account yet, which makes it the best moment to set things up. Exactly which items and how to set them is covered in detail in the next section; the advice is to go straight into it after signing up, and finish before you deposit.

Step 6 · Test with a small amount first

With the security settings in place, don't make your first deposit a big one. Deposit a small amount, withdraw a small amount, and run the whole flow through: confirm the deposit lands properly and that you're comfortable with checking the address and how the whitelist works on withdrawal, then think about scaling up. For the details on checking withdrawal addresses, picking the chain and running a small test, see the complete withdrawal security guide.

The hardening checklist to do on day one

This section is what we do best, and it's the biggest difference between this guide and an ordinary "sign-up tutorial": registering only hangs the door — hardening is what welds it shut. The items below are ordered by importance; switch them all on the day you sign up and you'll save yourself most of the grief down the line. To go through it all more systematically in one pass, you can head straight to the complete account security checklist, or run the account security check-up to score your account.

• Two-factor authentication (2FA) — the first thing to turn on. With it on, a password alone won't get anyone into your account. Don't rely on SMS alone (a SIM can be hijacked); favour an authenticator app (such as Google Authenticator), and add a security key / passkey as well if you can. For how the methods differ, see the 2FA methods comparison; for setup details, the complete 2FA guide. The backup recovery codes you're given, write them down offline and keep them safe — they're what you rely on when you change phones.
• Anti-phishing code. Once it's set, the genuine emails and in-app messages Binance sends you all carry this string you chose yourself; a "Binance" email without your code is almost certainly fake, so don't click it. Two minutes to set, and it blocks a whole swathe of phishing emails. For how to set it, see the anti-phishing code guide; if you're unsure whether a message is real, run it past the phishing message checker to weigh up a few tells.
• Fund password. It's separate from your login password and used for sensitive actions like withdrawals. The point of it: even if someone gets your login password and gets in, without the fund password they can't move your money. So the two passwords must be different — making them the same defeats the purpose. See how to set a fund password.
• Withdrawal address whitelist. With it on, the account can only send crypto to addresses you've added in advance, and unknown addresses simply can't be withdrawn to — this is the one thing that can still stop the coins if you're compromised. The trade-off is that a newly added address takes a cool-down period before it's active, so add your usual addresses ahead of time. See how to turn on the withdrawal whitelist.
• Glance at your logged-in devices while you're there. The account security settings show which devices and locations have logged into your account; kick off anything unfamiliar straight away and change your password. Coming back to scan it every so often is a cheap routine check-up. See device management and unusual logins.
• Remember two "lifeline" entry points: emergency freeze (freeze the account fast and pause sensitive actions when you suspect something's wrong) and the order of steps for recovering from a hack. Know where they are first and you won't panic when something does happen. For the full playbook, see what to do in the first ten minutes of a hack, and there's a hacked-account response decision tree you can just click through.

One closing note: the login password, 2FA backup recovery codes, anti-phishing code and fund password these settings produce are all, in effect, keys to your account, so don't take the easy route of stuffing them all in one place — and above all don't just screenshot them into your phone's photo roll or a chat, which is like hanging the whole bunch of keys on the door handle. The safe split is: write the recovery codes and fund password on paper offline and store them separately, hand the login password to a password manager, and keep the pieces apart. That way, even if one spot is found, you don't lose the lot at once. Managing keys for an exchange account works differently from a self-custody wallet; to understand the difference, see how exchange accounts and wallets actually differ.

Sign-up + hardening combined checklist

Here are the two sections above squeezed into one tick-box list to run through on sign-up day:

1. Confirmed Binance is legal to use where you live, with no VPN or false details used to get around it.
2. Reached the site from the official domain / a bookmark, having checked the domain in the address bar.
3. Registered with a long password not reused anywhere else.
4. If you chose to use it, confirmed that the registration page accepted invite code BN1899 and reviewed the displayed conditions.
5. Finished identity verification, with deposit, withdrawal and trading now enabled.
6. 2FA is on an authenticator app or a security key, with SMS only as a backup, and recovery codes stored offline.
7. Set an anti-phishing code, remembering it only appears in emails / in-app messages.
8. Set a fund password, and made it different from the login password.
9. Turned on the withdrawal address whitelist, with your usual addresses added.
10. Know where the emergency freeze and hacked-account recovery entry points are.
11. Ran the first deposit and withdrawal with a small amount first.

The traps beginners fall into most

Having walked the whole flow through, here are a few things it's easiest to take for granted, worth jotting down:

• "Deposit first, sort the security settings out later" — "later" usually means never, and that stretch with the account wide open is exactly the most dangerous. Doing it all on sign-up day is the least trouble.
• "Click the first search result and sign up there" — the top listing can be a copycat that paid for the ad slot; check the domain before you type anything.
• "Reuse the same password as another site to keep it simple" — reusing a password is the number-one reason accounts get taken over through credential stuffing.
• "Turned on SMS codes and called 2FA done" — SMS is the weakest option, and leaning on it alone is only half a setup.
• "Couldn't be bothered with a separate fund password, so made it the same as the login one" — that's fitting the second lock with the first lock's key.
• "Use a VPN to pretend you're signing up from another region" — you'll most likely get stuck at verification or withdrawal, and may trip risk controls too, so don't take the gamble.

Common questions