Why GitHub Made 2FA Mandatory
GitHub isn't protecting your cat photos: it's protecting the software supply chain. A single compromised maintainer account can push malicious code into a package pulled by millions of builds the same afternoon. Real attacks have worked exactly this way: hijack a tired maintainer's account, publish a poisoned release, and every downstream project inherits the malware. That's why GitHub rolled out mandatory 2FA for code contributors: your account security is other people's supply chain security.
Setting Up GitHub 2FA
- Click your profile photo → Settings.
- In the sidebar, open Password and authentication.
- Under Two-factor authentication, click Enable two-factor authentication.
- GitHub defaults to the authenticator app flow: scan the QR code with any TOTP app (Google Authenticator, Authy, Aegis, or your password manager).
- Enter the six digit code to verify.
- Download your recovery codes when prompted. GitHub is strict about lockouts: these codes matter.
The QR code is a standard otpauth URI with a Base32 secret (inspect one with our QR decoder, or watch a secret generate codes in our TOTP generator). Developers who want test secrets for their own implementations can grab them from our secret generator.
Level Up: Passkeys and Security Keys
GitHub's support for phishing resistant authentication is excellent, and developers are prime phishing targets (fake "your repo has a security alert" emails are a whole genre):
- Passkeys: Settings → Password and authentication → Add passkey. Sign in with your fingerprint or face, no code typing, immune to fake login pages. Background in our passkey explainer.
- Hardware security keys: Register a YubiKey or similar as a 2FA method. For maintainers of widely used packages, this is the professional standard: see our hardware key guide.
- Register two methods minimum (app plus key, or key plus passkey) so one lost device never locks you out.
The Parts 2FA Doesn't Cover (Developer Edition)
GitHub access happens through more doors than the login page. Audit all of them:
- Personal access tokens (PATs): Tokens bypass 2FA by design: they ARE authentication. Use fine grained tokens with minimal scopes and expiry dates, and treat a leaked token like a leaked password. Settings → Developer settings → Personal access tokens.
- SSH keys: Same story: review Settings → SSH and GPG keys and remove keys from old machines.
- OAuth apps: Third party tools you authorized years ago retain their access. Settings → Applications → Authorized OAuth Apps: revoke the stale ones. How OAuth grants work: our OAuth explainer.
- Never commit secrets: API keys in public repos get scraped within minutes by bots. Enable GitHub's secret scanning and push protection on your repos.
The classic developer compromise isn't a cracked password: it's a token in a public repo, a phished session, or an old OAuth grant. 2FA is the foundation; token hygiene is the rest of the building.
Recovery Planning (GitHub Is Strict)
GitHub deliberately limits account recovery for 2FA lockouts: too-easy recovery would be the attack vector. Your safety net, in order:
- Recovery codes, stored in your password manager or printed. Non negotiable.
- Multiple 2FA methods registered (app + passkey + key).
- A verified fallback where offered (GitHub can use a linked recovery method in some flows).
General storage strategy: our backup codes guide.
Frequently Asked Questions
Does 2FA affect git push and pull?
No. Git operations authenticate with SSH keys or tokens, not your password and 2FA code. Your daily workflow doesn't change at all: 2FA guards the web login, where account settings and dangerous actions live.
Which authenticator app should I use for GitHub?
Any TOTP app works. Developers often prefer open source options (Aegis on Android, or a password manager like Bitwarden that stores TOTP alongside logins). Our app comparison covers the field.
I contribute to open source casually. Does the mandate apply to me?
GitHub's requirement covers contributors to repositories, which in practice means most active users. Even if you somehow escaped the mandate, the answer is the same: enable it, it takes three minutes.
What happens if I lose all my 2FA methods and recovery codes?
GitHub's recovery process is intentionally hard and may not succeed: they'd rather lock you out than let an attacker in through a soft recovery flow. Prevention (multiple methods plus stored codes) is genuinely the only reliable answer here.
Should my organization require 2FA for all members?
Yes, and GitHub supports it: organization Settings → Authentication security → Require two-factor authentication. One unprotected member with write access is an open door to your codebase. Pair it with branch protection and required reviews for the full picture: our developer 2FA guide covers the application side too.
