GitHub Two-Factor Authentication: Setup and Recovery

GitHub 2FA protects your account with an app, passkey, security key or SMS. It is required for many code contributors; recovery codes are your safety net.

Methods GitHub supports

Turn it on

1. Go to Settings › Password and authentication.
2. Choose Enable two-factor authentication.
3. Scan the QR code with your authenticator app and enter the code.
4. Download or copy your recovery codes and store them safely.
5. Add a second method, such as a passkey or security key.

Required 2FA

GitHub has been requiring 2FA for accounts that contribute code, with notices and a deadline in your account. Organisations can also require it for members.

Lost your 2FA device

• Use a recovery code.
• Use another method you set up, such as a security key.
• If you have none, GitHub can sometimes verify you through an SSH key or personal access token previously used, but recovery is not certain.

Store recovery codes in a password manager, not only on the same phone as the authenticator.

Rate limits are different

"Too many requests" errors on GitHub are about API rate limits, not 2FA.

Tokens and SSH keys

2FA protects sign-ins on the website. Git operations over HTTPS use personal access tokens instead of your password, and SSH keys work as before. If your scripts fail after turning on 2FA, create a token with the scopes you need and use it in place of the password.

Organisations

An organisation can require 2FA for every member. Members without it may be removed until they turn it on, so set it up before a deadline to keep your access to repositories.

Keep a second method

Add two methods if you can, for example an authenticator app and a security key. Losing one then does not lock you out, and you avoid the slow recovery process.

FAQ

Is GitHub 2FA required?

For many accounts that contribute code, yes.

What if I lose my GitHub 2FA phone?

Use a recovery code or another 2FA method.

Can I use SMS for GitHub 2FA?

In some countries, but an app or passkey is safer.

Related: GitLab two-factor codes · passkeys · lost authenticator.