How to Set Up 2FA on GitHub (2026 Step-by-Step Guide)

Short answer: To set up 2FA on GitHub, go to Settings → Password and authentication, click Enable two-factor authentication, and scan the QR code with your authenticator app. GitHub now requires 2FA for accounts that contribute code, so this is not optional for most developers. Save your recovery codes before you finish — losing access to a GitHub account can mean losing access to your published work.

Why GitHub 2FA matters more than most accounts

A compromised GitHub account is not just a compromised login. An attacker can push malicious commits to repositories you maintain, publish poisoned package versions, steal secrets from private repos, and use your identity to social-engineer collaborators.

Supply chain attacks routinely begin with one maintainer’s stolen credentials. If you publish anything others depend on, your account security is other people’s security too. That makes phishing-resistant authentication methods worth the extra setup.

Step 1: Set up an authenticator app

1. Click your profile photo → Settings.
2. In the sidebar, select Password and authentication.
3. Under “Two-factor authentication,” click Enable two-factor authentication.
4. Choose Set up using an app.
5. GitHub shows a QR code. Scan it with your authenticator app.
6. Enter the six-digit code your app displays.

If you cannot scan the code — setting up on the same device, for instance — click the option to enter a setup key manually and paste it into your app.

Do not screenshot the QR code. It contains your raw secret key. Anyone with that image can generate your codes forever. If you want redundancy, scan the same code into a second app while it is on screen, then move on. Our authenticator app comparison covers which apps handle this well.

Step 2: Save your recovery codes

GitHub presents sixteen recovery codes immediately after setup. Download or print them now.

Store them offline or in an encrypted password manager — not in a repository, not in a plain text file on your desktop, and definitely not committed to git. People have accidentally pushed their own recovery codes to public repos.

These codes are your only guaranteed route back in if your phone disappears. Our guide on recovering accounts after phone loss explains what happens when you skip this step.

Step 3: Add a passkey or security key

Back on the authentication page, add a passkey or register a hardware security key.

This is worth doing on GitHub specifically. Passkeys are bound to github.com, so a lookalike phishing page cannot use them — and developers are heavily targeted by convincing fake login pages and OAuth consent screens. A TOTP code can be relayed by a phishing proxy; a passkey cannot. See passkeys vs 2FA for the full reasoning.

Register two hardware keys if you use them, and keep one somewhere safe.

Step 4: Fix your git command line

This is the step that trips people up. Once 2FA is on, your account password no longer works for git operations over HTTPS. Pushes and pulls will start failing with authentication errors.

You have two options:

Personal access token (HTTPS)

Go to Settings → Developer settings → Personal access tokens, generate a fine-grained token with only the scopes you need, and use it in place of your password when git prompts you. Set an expiry — tokens that never expire are a liability.

SSH keys (recommended)

Generate an SSH key pair, add the public key under Settings → SSH and GPG keys, and switch your remotes to SSH URLs. No tokens to rotate, no passwords to type.

The GitHub CLI (gh auth login) handles either flow for you if you would rather not do it manually.

Step 5: Check your organisations

If you belong to organisations, some require 2FA for all members. Enabling it may unlock repositories you were previously restricted from. If you own an organisation, consider requiring 2FA under organisation settings — but give members notice first, since anyone without it will be removed. The same logic applies to the infrastructure around your projects, such as securing your domain name with 2FA.

Frequently asked questions

Is 2FA mandatory on GitHub?

For accounts that contribute code — publishing packages, maintaining repositories, or belonging to certain organisations — yes. GitHub has rolled out mandatory 2FA for contributors. Read-only accounts have more latitude, but there is no good reason to skip it.

Why did my git push stop working after enabling 2FA?

Your account password is no longer valid for HTTPS git operations. Switch to a personal access token or SSH key. This is expected behaviour, not a bug.

Can I use SMS for GitHub 2FA?

GitHub supports SMS in some regions but actively discourages it, and coverage is limited. Use an authenticator app or passkey — SMS is vulnerable to SIM swapping, and a developer account is a high-value target.

What if I lose my phone and my recovery codes?

GitHub offers an account recovery process, but success is not guaranteed and it can take considerable time. If you have an SSH key still authorised on a machine you control, that may help verify your identity. This is why saving recovery codes matters.

Does 2FA affect GitHub Actions or CI?

No. Automated workflows authenticate with tokens or deploy keys, not interactive 2FA. Nothing in your CI pipeline needs to change.

Can I turn 2FA off later?

You can disable it under Password and authentication, but if your account contributes code, GitHub may require you to re-enable it or restrict your access.

The bottom line

GitHub 2FA takes five minutes and one follow-up task — switching your git authentication to SSH or a token. Do both in the same sitting so you are not debugging failed pushes tomorrow. And treat the recovery codes seriously: for many developers, a GitHub account represents years of work that cannot be recreated.

New to two-factor authentication generally? Start with our beginner’s guide to 2FA.