How to turn on two-factor authentication for GitHub
Last checked
Short answer
Where the setting is
On GitHub, the setting is under your profile picture: Settings, then Password and authentication, then Enable two-factor authentication.
GitHub’s help page says: “We strongly recommend using a time-based one-time password (TOTP) application to configure 2FA, and security keys as backup methods instead of SMS.” It also says: “GitHub is app-agnostic when it comes to TOTP apps, so you have the freedom to choose any TOTP app you prefer.”
Download a TOTP app of your choice to your phone or desktop.
In the upper-right corner of any page on GitHub, click your profile picture, then click Settings.
In the “Access” section of the sidebar, click Password and authentication.
In the “Two-factor authentication” section of the page, click Enable two-factor authentication.
Under “Scan the QR code”, scan the QR code with your mobile device’s app. If you can’t scan the QR code, click setup key to see a code, the TOTP secret, that you can manually enter in your TOTP app instead.
On GitHub, type the code into the field under “Verify the code from the app.”
Under “Save your recovery codes”, click Download to download your recovery codes to your device. Save them to a secure location because your recovery codes can help you get back into your account if you lose access.
After saving your two-factor recovery codes, click I have saved my recovery codes to enable two-factor authentication for your account.
GitHub explains why it prefers an app to text messages: “SMS is susceptible to interception, does not provide resistance against phishing attacks, has unreliable deliverability, and is not supported in all countries.”
Backup
Save your backup codes
GitHub shows your recovery codes in step 7 and asks you to confirm in step 8 that you saved them. Keep them somewhere apart from your phone. If you ever lose the phone, see our guide on what to do if you lose your phone.
