GitHub requires two-factor authentication from users who contribute code, and warns them with an enrollment deadline before locking them out until it is on. Beyond the requirement, a GitHub account signs commits, holds tokens and deploys to production — the kind of account where a phished password costs more than your own data.
Turn on two-factor authentication on GitHub
- Click your profile picture in the upper right corner and choose “Settings”.
- In the “Access” section of the sidebar, click “Password and authentication”.
- Click “Enable two-factor authentication”.
- GitHub shows a QR code. Leave it on the screen and add it to the extension as described below — or click “setup key” to copy the key for manual entry.
- Type the code from the extension under “Verify the code from the app” and continue.
Add GitHub to Authenticator
- Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
- Leave the GitHub page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
- The account appears in the list with a six-digit code that changes every 30 seconds. Rename it if you like — the name is only for you.
- Go back to GitHub and type the current code into the confirmation field. If it is about to expire, wait for the next one.
- GitHub confirms that two-factor authentication is on. From now on it will ask for a code when you sign in — click the extension icon and copy it.
No QR code, or it will not scan? Look for the option to enter a key manually on GitHub’s setup screen, copy the key, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.
Get 2FA Authenticator for Chrome — freeDownload your 16 GitHub recovery codes
The next step in setup is “Save your recovery codes”: click “Download”, keep github-recovery-codes.txt somewhere other than this computer, and confirm with “I have saved my recovery codes”. You can view them again, or generate a new set (which cancels the old one), under Password and authentication → Recovery codes. GitHub also asks you to confirm 2FA still works during a 28-day check-up after you turn it on.
The code is not accepted?
Almost always the computer’s clock. The codes are calculated from the current time, so a clock that is a minute off produces codes that look right and are refused. Turn on automatic date and time in your system settings — step-by-step for Windows, macOS and Linux.
If the clock is right, check the key itself: paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.
Questions
- Is 2FA required on GitHub?
- For users who contribute code, yes. GitHub notifies you, gives you an enrollment period to turn it on, and after a short grace period blocks access until 2FA is enabled.
- Can I use a browser extension instead of a phone app for GitHub?
- Yes. GitHub accepts any TOTP app. The Authenticator extension keeps the codes in Chrome, on your device only, and can be locked behind a password. For the most sensitive accounts add a passkey or security key to GitHub as well — GitHub supports several methods at once.
- What if I lose my authenticator for GitHub?
- At the 2FA prompt, open “More options” and use a recovery code, a passkey, a security key or fallback SMS if you set one up. Without any of them, GitHub’s account recovery request takes several business days, and GitHub Support cannot restore access without proof you own the account.
- Where is the GitHub setup key?
- On the QR code step, click “setup key”. GitHub shows the key as text — copy it into the extension with “Add Account” → “Manual” → “Secret Key”.
Your codes, one click from the login page
Authenticator keeps your 2FA codes in the browser, on your device only — free, open source, no account and no phone needed. Local backups and optional password protection come built in.
Get 2FA Authenticator for Chrome — free