How to Enable Two-Factor Authentication on GitHub

GitHub mandated two-factor authentication for all active contributors in 2023, and for good reason. Your GitHub account controls access to code repositories, deployment pipelines, CI/CD secrets, and potentially production systems. Compromised developer accounts are one of the primary vectors for software supply chain attacks — attackers gain access to a trusted account and inject malicious code into packages used by thousands of other projects.

Setting up 2FA on GitHub takes less than two minutes and dramatically reduces the risk of account takeover. Here is everything you need to know.

Why GitHub 2FA Matters

GitHub is the world's largest code hosting platform, hosting over 200 million repositories. A compromised GitHub account can lead to:

• Code theft and intellectual property loss — attackers can clone private repositories, steal proprietary code, and sell it or use it to find vulnerabilities in your software.
• Supply chain attacks — by gaining access to a maintainer's account, attackers can push malicious commits to popular open-source packages, affecting every project that depends on them. This is how the SolarWinds and Codecov breaches unfolded at scale.
• Personal access token exposure — GitHub personal access tokens (PATs) often have broad permissions. An attacker who takes over your account can generate new PATs and use them to access CI/CD systems, cloud deployments, and container registries.
• Organization compromise — if you have admin access to a GitHub organization, account takeover can give attackers control over multiple repositories, team memberships, and billing information.

For a deeper look at what 2FA is and how it works, see What Is Two-Factor Authentication?

How to Set Up 2FA on GitHub (Step by Step)

1. Sign in to github.com and click your profile photo in the top right, then click Settings.
2. In the left sidebar, click Password and authentication.
3. Under "Two-factor authentication", click Enable two-factor authentication.
4. GitHub displays a QR code. Open your authenticator app (Google Authenticator, Authy, 1Password, etc.), tap Add Account, and scan the QR code. If you cannot scan it, click enter this text code to get a plain-text secret key you can type manually. For a detailed comparison of authenticator apps, see Best Authenticator Apps of 2026.
5. Enter the 6-digit TOTP code shown in your authenticator app to confirm the setup.
6. GitHub will display 16 recovery codes. Download or print them immediately and store them somewhere safe — a password manager is ideal. These are your only way back in if you lose your authenticator device.

GitHub's 2FA Options — Which Should You Use?

GitHub supports several different second factors. Each has different trade-offs between security, convenience, and recovery options. The best choice depends on your specific needs — passkeys vs. 2FA is a common comparison, and hardware keys vs. authenticator apps covers the trade-offs in more depth.

Authenticator App (TOTP) — Recommended for Most Developers

Any TOTP-compatible app works: Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and many others. When you sign in, GitHub asks for the 6-digit code currently shown in your app. Codes refresh every 30 seconds. This method works offline and is not vulnerable to SIM swapping. It is the best default choice for most developers.

Hardware Security Keys — Best for High-Value Accounts

Physical keys like YubiKey connect via USB or NFC. Instead of typing a code, you simply tap the key when prompted. Hardware keys implement the WebAuthn/FIDO2 standard, which is phishing-resistant — the key cryptographically verifies the exact domain, so it will not authenticate on a fake login page. If your account has access to critical repositories or has admin rights over an organisation, a hardware key is the best option.

GitHub Mobile — Convenient Push Approvals

If you have the GitHub mobile app installed and signed in, GitHub can send a push notification to your phone asking you to approve the login. You review the request and tap Approve. This is convenient but requires internet connectivity on both your phone and your computer at the time of sign-in.

Passkeys — The Best Long-Term Option

Passkeys use your device's biometrics (Face ID, fingerprint, Windows Hello) to authenticate. They are phishing-resistant like hardware keys but more convenient since they are built into your device. GitHub is actively rolling out passkey support. If your device supports it, consider adding a passkey as your primary 2FA method and keeping an authenticator app as a fallback.

SMS Codes — Avoid If Possible

GitHub supports SMS as a fallback 2FA method, but it is the least secure option due to SIM-swap attacks. Use an authenticator app or hardware key instead, and only fall back to SMS if no other option is available.

What Happens After You Enable 2FA on GitHub

Once 2FA is active, every sign-in from a new browser or device requires both your password and your second factor. Existing sessions on trusted devices are not immediately logged out. You can manage your trusted devices in Settings → Password and authentication.

GitHub also requires 2FA to perform sensitive actions like adding SSH keys, creating personal access tokens, and changing your email address — even from a device you are already signed in to.

GitHub 2FA and the Command Line

2FA does not affect Git operations over SSH or HTTPS once you have set up proper credentials. For HTTPS, use a personal access token (PAT) or GitHub CLI token as your password — not your account password. For SSH, use an SSH key pair. Neither method is affected by account-level 2FA.

Troubleshooting GitHub 2FA

My authenticator app is not showing the right code

Authenticator codes are generated based on your device's clock. If the codes are consistently incorrect, check that your phone's date and time are set to automatic (Settings → Date & Time). Even a few seconds of clock drift can cause TOTP codes to fail.

I lost my phone with the authenticator app

Use one of your saved recovery codes. Each code can be used exactly once. If you also lost your recovery codes, you will need to go through GitHub's account recovery process, which requires email verification and may take several days.

My hardware key stopped working

Try using a different USB port or a USB-C adapter. Some older YubiKeys require the FIDO2 interface to be enabled. If the key is physically damaged, use your recovery codes to sign in and register a new key immediately.

2FA is not sending me SMS codes

Make sure your phone number is correct in GitHub Settings → Password and authentication. If SMS delivery is delayed, your mobile carrier may be filtering automated messages. Try requesting a new code after 30 seconds. If the problem persists, use an authenticator app instead.

GitHub 2FA FAQ

Does GitHub require 2FA for all users?

Yes. GitHub requires 2FA for all users who contribute code on the platform, including maintainers of public repositories. Accounts without 2FA enabled have limited functionality as of 2024.

What is the best 2FA method for GitHub?

For most developers, an authenticator app (TOTP) is the best balance of security and convenience. For high-value accounts — especially those with organization admin access — a hardware security key like YubiKey provides the strongest protection. Passkeys are also an excellent phishing-resistant option if your device supports them.

Can I use multiple 2FA methods on GitHub?

Yes. GitHub lets you register multiple 2FA methods simultaneously. It is strongly recommended to have at least two methods configured — for example, an authenticator app as your primary method and a set of saved recovery codes as your backup. You can also add a hardware key, passkey, and GitHub Mobile alongside your authenticator app.

Does GitHub 2FA work with SSH keys?

2FA does not apply to SSH key authentication for Git operations. If you use SSH keys to push and pull code, your existing workflow is unaffected after enabling 2FA. For HTTPS Git operations, you will need to use a personal access token instead of your password.

What happens if GitHub's 2FA servers are down?

Authenticator app (TOTP) codes are generated locally on your device and do not require GitHub's servers to be reachable. Hardware keys and passkeys also work offline. SMS codes will not work if GitHub's SMS delivery system is down. If GitHub's authentication servers are unavailable, you can still use recovery codes to sign in.

How do I disable 2FA on GitHub?

Go to Settings → Password and authentication → Two-factor authentication and click Disable two-factor authentication. You will be prompted to confirm with your current 2FA method. GitHub recommends deleting existing recovery codes and downloading new ones after disabling and re-enabling 2FA.

Can I set up 2FA for a GitHub organization?

GitHub organization owners can require 2FA for all members by enabling the Require two-factor authentication option under Organization Settings → Authentication security. This applies to all members and outside collaborators of the organization. Users who do not have 2FA enabled will be removed from the organization until they enable it.