Sign In

GITHUB ACCOUNT GUIDE

How to enable 2FA on GitHub

Protect your GitHub account with a second sign-in step. This guide covers personal accounts using Sign In for verification codes, plus recovery options if your phone is unavailable.

Before you start

Have access to your GitHub account, your iPhone, and a safe place to store recovery codes. Enterprise Managed Users normally use their organization’s identity provider; ask your administrator about that setup.

Open GitHub’s 2FA setup

  1. Open GitHub in a browser and sign in.
  2. From your profile picture, open Settings → Password and authentication.
  3. Choose Enable two-factor authentication. Keep the QR-code setup page open while you add the account below.

Open GitHub security settings →

Add GitHub to Sign In

For verification codes on iPhone, we recommend Sign In, our authenticator app. It generates your codes on your device.

  1. If GitHub’s QR code is on another screen, choose Add → Scan QR Code in Sign In and scan it.
  2. For setup on one iPhone, choose setup key on GitHub. In Sign In, choose Add → Enter Setup Key. Enter GitHub as the Service, your username as the Account, and paste the key into Key.
  3. Review the details and tap Add Account.
  4. Return to GitHub and confirm with the current six-digit code from Sign In.
  5. Download your recovery codes, store them securely, and confirm that you have saved them to finish enabling 2FA.

Keep the setup key private. Adding an entry in Sign In alone does not finish GitHub’s enrollment.

Other supported methods

After initial enrollment with authenticator codes or SMS, GitHub offers additional options: passkeys, hardware security keys, and its built-in mobile approval flow. Passkeys and security keys offer phishing resistance that typed codes do not.

SMS is available only in supported countries and may be restricted by your organization. Consider its delivery and phone-number takeover risks when choosing a backup.

Save recovery codes

Keep recovery codes somewhere accessible even if you lose your phone. Each works once. In Settings → Password and authentication, choose View beside Recovery codes to save them again. Generating a replacement set invalidates the old set.

Before relying on your setup, complete a sign-in with 2FA and confirm that your backup method is available. Avoid putting every recovery option on the same device.

If you are locked out, try a saved recovery code or a previously configured alternative. GitHub’s account recovery instructions explain other eligible recovery options. Support cannot simply remove 2FA when all authentication and recovery options have been lost.

If a code is rejected

  • Check that you selected the correct GitHub username in Sign In. GitHub does not send authenticator codes by text.
  • Wait for a fresh code and enter it promptly, without spaces.
  • Check that your iPhone’s date and time are set automatically.
  • For a failed recovery code, use an unused code from the latest set. A previously used or replaced code will not work.

Official GitHub help

Documentation reviewed October 8, 2026.

Browse all guides →