Two-factor authentication, or 2FA, is a way of logging into websites that requires more than just a password. Using a password to log into a website is susceptible to security threats, because it represents a single piece of information a malicious person needs to acquire. The added security that 2FA provides is requiring additional information to sign in.
In GitHub's case, this additional information is an authentication code delivered to your cell phone, either generated by an application on your smartphone, or sent as a text message (SMS). After 2FA is enabled, GitHub generates an authentication code that is sent to your phone any time someone attempts to sign into your GitHub account. The only way someone can sign into your account is if they know both your password and have access to the authentication code on your phone.
Tip: GitHub Enterprise cannot send authentication codes as SMS messages—it only supports TOTP smartphone clients, such as Google Authenticator.
We strongly urge you to turn on 2FA for the safety of your account, not only on GitHub, but on other websites that support it. You can use 2FA to access GitHub via:
- The GitHub website
- The GitHub API
- GitHub for Windows
- GitHub for Mac
Warning: For security reasons, GitHub Support cannot restore access to accounts with two-factor authentication enabled if you lose your phone and don't have access to your recovery codes.
We recommend authenticating with a Time-based One-Time Password (TOTP) application, which automatically generates an authentication code that changes after a certain period of time. TOTP applications are more reliable than SMS, especially for locations outside the US. For more information, see Configuring two-factor authentication via a TOTP mobile app.
If you're unable to authenticate using a TOTP mobile app, you may be able to generate codes using SMS. This method isn't recommended for non-US numbers. For more information, see Configuring two-factor authentication via text message.
After successfully setting up 2FA, you'll be provided a set of randomly generated recovery codes that you should view and save. We strongly recommend saving your recovery codes immediately. If you don't, though, you can download them at any point after enabling two-factor authentication. For more information, see Downloading your two-factor authentication recovery codes.
You can provide a second number for a fallback device. If you lose access to both your primary device and your recovery codes, a backup SMS number can get you back in to your account.