How to Enable Two-Factor Authentication (2FA) on GitHub

If you are a software developer, your GitHub account is likely one of your most valuable digital assets. It contains your private source code, your professional portfolio, and potentially access keys to production servers. A compromised GitHub account can lead to disastrous supply chain attacks, which is why GitHub recently made Two-Factor Authentication (2FA) mandatory for active contributors.

Even if you have not been strictly forced to upgrade your security yet, you should proactively learn how to enable two-factor authentication on GitHub. By relying on a time-based authenticator app rather than just a password, you ensure that even if your password is leaked in a data breach, your source code remains impenetrable.

Choosing an Authenticator App

Before you begin the setup process on GitHub, you must install a Time-based One-Time Password (TOTP) authenticator app on your smartphone. When you attempt to log in to GitHub, this app will generate a unique, temporary 6-digit code that expires every 30 seconds.

We highly recommend avoiding SMS text messages for 2FA, as they are vulnerable to SIM-swapping attacks. Instead, install one of the following reputable authenticator apps on your iOS or Android device:

• Aegis Authenticator (Android only, open-source and highly secure)
• Ente Auth (Cross-platform, open-source with encrypted cloud backups)
• Google Authenticator or Microsoft Authenticator (Standard, reliable corporate options)
• Authy (Popular but migrating to open-source alternatives is often recommended)

How to Enable 2FA in Your GitHub Settings

Once your authenticator app is installed and ready, you can configure your GitHub account.

1. Open your web browser, navigate to GitHub.com, and log in with your current username and password.
2. In the extreme top-right corner of the screen, click on your profile picture to open the drop-down menu.
3. Select Settings near the bottom of the list.
4. In the left-hand sidebar of your settings page, locate the “Access” section and click on Password and authentication.
5. Scroll down to the “Two-factor authentication” section and click the green button labelled Enable two-factor authentication.
6. GitHub will now display a large QR code on your computer screen.

Scanning the QR Code

You now need to link your phone’s authenticator app to the GitHub server.

1. Open the authenticator app on your smartphone.
2. Tap the + (Plus) icon or the “Add Account” button within the app.
3. Select Scan a QR code. Your phone’s camera will activate.
4. Point your phone camera at the QR code displayed on your computer monitor. The app will instantly recognise it and add a new entry labelled “GitHub.”
5. The app will immediately begin generating 6-digit codes. Look at the current code displayed on your phone, type it into the verification box on the GitHub website, and click Continue.

The Critical Step: Save Your Recovery Codes

The moment you successfully verify your 6-digit code, GitHub will redirect you to a page displaying a list of Recovery Codes. This is the most crucial step of the entire process.

If you drop your phone in a lake or accidentally delete your authenticator app, you will be permanently locked out of your GitHub account. These recovery codes are your only lifeline to bypass the 2FA requirement and regain access to your repositories.

1. Click the Download button to save the codes as a text file to your computer.
2. Alternatively, click Print and keep a physical paper copy in a secure location, like a fireproof safe.
3. Store these codes securely inside a robust password manager.
4. Once you have safely stored the codes, click the button confirming you have saved them.

Your GitHub account is now secured by two-factor authentication, practically eliminating the risk of unauthorised access.