What Actually Happens If You Miss the 2FA Deadline
GitHub does not ask nicely forever. When your account falls into a group required to enable 2FA, you get a countdown banner across the site, then a hard wall: you can still read code and clone repositories, but pushing, commenting, opening issues, and merging pull requests all get blocked until you comply. If you are mid-review on a pull request when the deadline hits, the PR sits untouched until you fix your account, not until someone remembers to check on it. Teams have shipped late because a maintainer's enforcement date landed on a Friday and nobody noticed until Monday standup.
The requirement itself grew out of a string of real supply chain incidents: attackers taking over maintainer accounts with weak or reused passwords and slipping malicious commits into packages that thousands of other projects pull in automatically. GitHub decided that if you can push code other people's builds will trust, your login needs to be harder to steal than a password alone. That is the whole logic of the mandate, and it explains why the rollout has no opt-out for active contributors.
Setting Up Your First Factor
- Click your profile photo in the top right, then Settings.
- In the left sidebar, choose Password and authentication.
- Under "Two-factor authentication," click Enable two-factor authentication.
- GitHub will offer an authenticator app first. Scan the QR code with Google Authenticator, Authy, Aegis, 2FAS, or a password manager that stores TOTP entries.
- Type in the six digit code the app is currently showing to confirm the pairing.
- GitHub then forces you to download or copy a set of recovery codes before it lets you continue. Do not skip this screen or click past it without saving the codes somewhere durable.
Under the hood, that QR code is a standard otpauth link containing a Base32 secret, the same format every TOTP app understands. If you ever want to see what is actually encoded in a setup QR before scanning it, our QR decoder will read it out in plain text, and our TOTP generator lets you paste any secret and watch the live codes it produces.
Registering a Second, Faster Method
Six digit codes work, but GitHub's phishing resistant options are worth the extra five minutes, especially if you maintain anything other people depend on:
- Passkeys. Settings > Password and authentication > Add a passkey. Once registered, sign-in becomes a fingerprint or face scan with no code to type and nothing a fake login page can capture. Background on how the cryptography behind this works is in our passkey explainer.
- Hardware security keys. A YubiKey or similar FIDO2 key registers the same way, and is the standard expectation for maintainers of packages with heavy download counts. Our hardware key guide walks through picking and setting one up.
- GitHub Mobile as a fallback approval. If you have the app installed and signed in, GitHub can push a sign-in approval to your phone instead of asking for a code, which is faster on a machine you use daily.
Register at least two of these methods. A single method tied to a single device means one lost phone equals one locked account, and GitHub's recovery process is not fast.
The Access Points 2FA Never Touches
This is the part contributors miss most often: 2FA protects the login page, but GitHub access also flows through tokens and keys that bypass that page entirely by design.
- Personal access tokens. A token authenticates git operations and API calls on its own, no 2FA prompt involved. Go to Settings > Developer settings > Personal access tokens and prefer fine grained tokens scoped to one repository with an actual expiration date, not "no expiration." A leaked classic token with full scope is functionally a stolen account.
- SSH keys. Settings > SSH and GPG keys accumulates entries from every laptop you've ever pushed from. Delete anything tied to a machine you no longer own; an old key on a sold laptop is a standing door.
- Authorized OAuth apps. Settings > Applications > Authorized OAuth Apps lists every third party tool you've ever granted repo access to, including CI services and browser extensions you tried once in 2022. Revoke anything you don't recognize. Our OAuth explainer covers what these grants actually permit.
- Secret scanning. Turn on secret scanning and push protection under your repository's Security settings. Bots crawl public GitHub for exposed API keys within minutes of a bad commit, and push protection stops the commit before it ever lands.
Recovery Before You Need It
GitHub deliberately makes account recovery difficult when 2FA is lost, because an easy recovery path is exactly what an attacker would exploit instead of guessing your password. There is no phone call that fixes this quickly. Your safety net has to exist before the emergency:
- Recovery codes saved in a password manager, not a text file on the same laptop that might get stolen or wiped.
- A second registered method, ideally a different type (app plus passkey, or key plus passkey), so losing one device doesn't strand you.
- A verified, current email address on the account, since it factors into whatever recovery path GitHub does offer.
General guidance on where backup codes should physically live is in our backup codes storage guide.
Organizations: Turning This Into a Policy
If you administer an organization, individual good habits are not enough. Go to your organization's Settings > Authentication security and enable "Require two-factor authentication for everyone in this organization." Members who don't comply get removed from the org automatically, not just warned, so give people notice before you flip it. Pair this with required reviews and branch protection rules; 2FA stops account takeover, but it does not stop a legitimately logged-in but careless contributor from merging unreviewed code. Our developer 2FA guide covers the application-side half of that picture.
Frequently Asked Questions
My 2FA enforcement deadline hit while I had an open pull request. Is my work lost?
No. The PR and its commits stay exactly as they were; you just can't push new commits, comment, or merge until your account is compliant again. Enable 2FA and the block lifts immediately, no data loss involved.
Do git push and git pull ask for a 2FA code?
No. Git operations over HTTPS or SSH authenticate with a personal access token or an SSH key, never with your password and 2FA code together. Your daily command line workflow is unaffected; 2FA guards the web login where account settings and destructive actions live.
I'm an occasional contributor with one small PR merged years ago. Does the mandate still apply to me?
GitHub's enforcement targets accounts that contribute code, and it rolls out in waves rather than all at once, so you may simply not have been reached yet. Enabling it now costs three minutes and avoids finding out the hard way mid-project.
What if I lose my phone, my recovery codes, and I never registered a second method?
This is the scenario GitHub's process is built to be slow for. You'll go through an identity-verification recovery flow that can take days and is not guaranteed to succeed, particularly on accounts with no verified email. The fix is entirely preventive: register two methods and store your codes before this happens, not after.
Should I require security keys instead of just authenticator apps for my organization's maintainers?
For anyone with write access to a widely depended-upon package, yes if you can manage the logistics of distributing keys. Authenticator apps stop credential stuffing and most phishing; hardware keys stop the more targeted phishing attacks that authenticator codes can still be tricked out of on a convincing fake login page.
