Skip to main content
In this lesson you’ll learn how to enable two-factor authentication (2FA) for a GitHub account, review the available sign-in methods, and choose the most secure option for your workflow. We’ll cover the authentication options listed on the GitHub “Password and authentication” page, how to register an authenticator app, and where to store recovery codes.

​
1. Open GitHub account settings

  • Sign in to GitHub and go to Settings → Access → Password and authentication.
  • This page lists the sign-in methods available to your account and what is already configured. For example, an account that uses Google single sign-on will show no local password configured but will list verified email addresses and other sign-in options such as Apple, passkeys, and biometric/passwordless sign-in.
Clicking Add passkey starts the passkey registration flow on your device (this may trigger an OS prompt or browser dialog). If the registration fails or you decide not to proceed, click Cancel to return to the settings page.
The image shows a GitHub interface for configuring passwordless authentication with a notification that "Passkey registration failed." There are options to add a passkey or cancel the process.

​
2. Locate Two-factor authentication

Scroll to the Two-factor authentication section on the “Password and authentication” page. If you haven’t enabled 2FA for the account yet, you’ll see an option to enable it.
The image shows a GitHub "Password and authentication" settings page, indicating that two-factor authentication is not enabled, with an option to enable it.
GitHub recommends using an authenticator app to generate time-based one-time passwords (TOTP). Popular choices include: When you select to set up with an authenticator app, GitHub displays a QR code that your authenticator app can scan. The app will then generate a 6-digit code (TOTP) that you enter into GitHub to verify the setup.
The image shows a GitHub webpage prompting the user to enable two-factor authentication (2FA) using an authenticator app. It includes a QR code for scanning and a field to enter a verification code.
Steps to enable 2FA with an authenticator app:
  1. Open your authenticator app on your mobile device (Google Authenticator, Microsoft Authenticator, 1Password, etc.).
  2. Scan the QR code displayed in GitHub or manually enter the provided secret.
  3. Enter the 6-digit code generated by the app into GitHub and submit.
  4. GitHub verifies the code and completes the setup.
After verification, GitHub will show that the authenticator app is configured as a second factor and will provide recovery codes.
The image shows a GitHub settings page for configuring two-factor authentication, with a message indicating that two-factor authentication has been enabled using an authenticator app. Confetti is visible on the screen, likely celebrating the completion of the setup.

​
4. Recovery codes and account recovery

GitHub provides one-time recovery codes that allow access if you lose your authenticator device. Save these codes immediately after setup:
  • Store recovery codes in a reputable password manager (for example, 1Password).
  • Consider using authenticator apps with encrypted cloud backup (for example, Authy) to make TOTP recovery easier—but do not rely solely on backup features in place of securely stored recovery codes.
  • You can download or view recovery codes from the GitHub UI. See GitHub Docs: Managing two-factor authentication recovery codes.
Once setup is complete, the Two-factor authentication section will indicate that 2FA is enabled and list all configured second-factor methods.
The image shows a GitHub security settings page focused on two-factor authentication options, including the use of an authenticator app, SMS/text message, security keys, and GitHub Mobile for enhanced account security.

​
5. Compare available 2FA options

​
Final recommendations

  • Prefer authenticator apps or hardware security keys over SMS.
  • Save recovery codes to a secure location right after setup.
  • Consider using a password manager that supports secure storage of recovery codes and passkeys.
Save recovery codes immediately after setup and store them in a secure place (for example, a reputable password manager). Avoid relying on SMS as your primary second factor when stronger options (authenticator apps or security keys) are available.
References:

Watch Video