SMM Panel Asking for Your Password? Don't Give It
Some growth services still ask for your Instagram password in their terms. What that gives them, what Instagram says, the SocialCaptain leak and what to do.
An order for followers, likes or views needs a username or a post link. A service that asks for your password wants to log in as you, and some still say so in writing. "To provide the Service We require the Customer's username and password for the social media Account," say the terms of both Upleap and Flock Social. Instagram's help center warns that apps given your login can take control of your account, by a web search on October 24, 2026. We sell followers, likes and views, and we never ask for a password, so read this as a seller's page.
Quick Answer: Don't give it. A panel only needs your username or a post link to deliver an order. With your password, a service can log in and act as you, and Instagram says it may remove the likes such apps generate and limit or disable accounts that keep using them. If you've already shared it, change it, change it anywhere else you used it, and turn on two-factor authentication, as the FTC advises.
Which services ask for a password?
| Service | What it asks | Source |
|---|---|---|
| Flock Social | Username and password | Terms, 2025 |
| Upleap | Username and password | Terms, 2022 |
| Kicksta | Your Instagram login | Pricing page |
| HCLOUT | A username or link | Order form |
Flock Social's terms (dated October 15, 2025 in the page's code), Upleap's terms (updated November 30, 2022) and Kicksta's pricing page, read through our server on October 22 to 24, 2026.
Flock Social and Upleap use the same sentence in their terms. Flock Social also asks you to consent to "a login from one of Our hubs, which may be in a different geographical region." Kicksta's FAQ answers "Does Kicksta need my Instagram password?" with "Yes." These services follow and unfollow from your account, which is why they want the login. Our page on whether you need a password to buy followers compares more of them.
What does your password give them?
Everything you're able to do in the app. Instagram's help center says apps that get your username and password, or an access token, can take control of your account, by the web search. It adds that if it looks like you've shared your login with one of these apps, Instagram may remove the likes they generated, and that repeat use can lead to limits or a disabled account. Its data scraping page lists giving your login to "apps that offer likes or followers" as something that can get an account restricted.
It's happened before. In 2013, Symantec found that "many Instagram users have willingly shared their usernames and passwords to a bot-like app in order to increase likes and followers." That app was InstLike. "Until you change your Instagram password, your account will be used for auto-liking and auto-following," Symantec warned. In 2015, InstaAgent was pulled from both app stores "after a researcher warned that it lifted users' names and passwords without their knowledge," Infosecurity Magazine reported.
What happened at SocialCaptain?
Its stored passwords leaked. "Social Captain, the social media boosting service, which bills itself as a service to increase user's Instagram followers, has exposed thousands of Instagram account passwords after storing them in unencrypted plain text," Information Security Buzz wrote on January 31, 2020. TechCrunch, which broke the story, said a researcher gave it a spreadsheet of about 10,000 scraped accounts, by a web search on October 24, 2026. A service that's got your password can lose it too. Our page on the SocialCaptain data breach has more.
What should you do if you already gave it?
- Change your Instagram password. The FTC says to "Create a new, strong password for the account that was compromised." Instagram's help center says a password change logs out other devices.
- Change it anywhere you reused it. "If you use the same password on another account, change it there, too," the FTC adds.
- Turn on two-factor authentication. That's the FTC's next step.
- Remove the app's access. Instagram's help center says to remove the app under its website permissions settings, by the web search.
- Cancel in writing. Keep proof, and check the cancellation rule first. Flock Social's terms, for example, need a request through support at least 24 hours before the next billing cycle.
If you've already lost the account, our guide to a hacked Instagram account walks through recovery.
How do you spot a password grab?
- A password field at checkout. An order for followers, likes or views doesn't need one.
- A login page that isn't Instagram's. Check the address bar before you type anything.
- A request for a login code. A verification code opens your account just like a password, so don't share it.
- An app that wants your login to "deliver." InstLike and InstaAgent both worked this way.
Is an SMM panel safe?
A password is one risk, and there are others. Payment is the second: a card keeps a dispute route open, and crypto payments "typically are not reversible," the FTC says. Instagram's rules are the third. In 2018, it said it would begin "removing inauthentic likes, follows and comments from accounts that use third-party apps to boost their popularity." That applies to every seller, ours included.
Where does HCLOUT fit?
We sell followers, likes and views, so read this as a seller's pitch. Orders need a link or a username, and we never ask for your password. If an order fails or only partly delivers, we refund it automatically to your HCLOUT balance, and you can ask to withdraw it. Our support is real human support, 24/7. Our free tier gives 12 free Instagram likes or 100 free Instagram views on a public post, with an email.
Frequently asked questions
Why would an SMM panel ask for my password?
Because it wants to act from your account, by following, unfollowing or liking as you. Flock Social, Upleap and Kicksta say so in their own terms or pages.
Is it safe to give an SMM panel my password?
No. Instagram's help center says apps with your login can take control of your account, and SocialCaptain's stored passwords leaked in 2020.
What does an SMM panel actually need from me?
Your username or a post link, an email for the order, and a payment. That's all.
What should I do if I already gave my password?
Change it, change it anywhere you reused it, turn on two-factor authentication and remove the app's access, as the FTC and Instagram advise.
Is an SMM panel safe?
It depends on the panel and on what you hand over. Never share a password, pay by card if you can, and know that Instagram removes engagement it judges inauthentic.
What happened to SocialCaptain?
In January 2020, reports said it had stored thousands of Instagram passwords in plain text, and a researcher scraped about 10,000 accounts.
Sources
- Upleap's terms (updated November 30, 2022), Flock Social's terms and Kicksta's FAQ and pricing page, read through our server on October 22 to 24, 2026
- Instagram's help center pages on apps that offer likes and followers and on data scraping, as a web search showed them on October 24, 2026, and Instagram's announcement of November 19, 2018
- Symantec, "Instagram Users Compromise Their Own Accounts for Likes," November 12, 2013, in the Internet Archive, and Infosecurity Magazine, November 13, 2015
- Information Security Buzz, January 31, 2020, read October 24, 2026, and TechCrunch's January 2020 report as a web search showed it
- FTC, "What To Do if You Were Scammed" and its crypto guidance, read October 24, 2026
- Hclout's FAQ and free tier, read October 24, 2026
Want the growth without the research?
Real accounts, 30-day refill, no password ever asked for.