How to Enable 2FA on your Github Account (Two-Factor Authentication)

In early 2024, Github will require its users to configure two-factor authentication (2FA) on its platform. Depending on your account, the due date may vary.

You can enable two-factor authentication (2FA) on your Github account in the Settings, under the “Password and authentication” section. You can use either a time-based one-time password (TOTP) application or your mobile text-messaging.

How to Configure 2FA on Github?

To configure 2FA on Github, go the “Setup authenticator app” and follow these steps:

1. Access the “Setup authenticator app”
2. Download a TOTP application of your choice (Google Authenticator, 1Password, Authy, …)
3. Scan the QR code
4. Enter the validation code
5. Download your recovery codes

1. Access Setup Authenticator App

Access the “Setup authenticator app” by clicking on the “Enable 2FA” button on the banner of the homepage of your Github account.

If the banner is not available, simply click on your image profile in the top right of your account.

Go to Settings > Password and Authentication (under the Access section on the left). Then click on the “Enable two-factor authentication (2FA)” button at the bottom of the page, below the “Two-factor authentication” section.

By, now you should see the “Enable two-factor authentication (2FA)” screen showing the QR code that you will need to scan.

If the banner is not available, or if you don’t see the “Two-factor authentication is not enabled yet”, message it is possible that your account already has 2FA enabled.

2. Download a TOTP Application

Github recommends to use a time-based one-time password (TOTP) application (e.g. Google Authenticator) and security keys as backups instead of SMS. The reason is that TOTP applications are more reliable than SMS.

As an additional upside, is that it is persistent regardless of your phone. If, like me, you change cell phone number quite often, it is easy to loose track of which app use your mobile for 2FA, and it is easy to loose access to an application simply because you don’t have the phone number anymore. TOTP apps help with this issue.

Download any TOTP application. I use Google Authenticator because it is free and easy to transfer to a new phone.

3. Scan the QR Code

Next, scan the QR Code in Github “Setup authenticator app” by first going to the TOTP application (in our case Google Authenticator).

Open the Google Authenticator application and click on “Add a code”.

Then, click on “Scan a QR code”.

The screen on your phone will change to a screen with a green square allowing you to scan the QR code.

On Desktop, go back to the “Enable two-factor authentication (2FA)” screen and scan the QR code.

4. Enter the Validation Code

In your authentication application you will receive a validation code.

Add the code right below “Verify the code from the app”, and click on continue.

5. Download your Recovery Codes

Next, you should definitely download your recovery codes and store them somewhere safe.

I store them in LastPass in case I ever need them.

Congratulations, you now have 2FA enabled on Github.

Enable 2FA with SMS on Github

Enabling two-factor authentication with SMS on Github is done on the “Setup authenticator app” by moving down the page to the “SMS authentication” section.

Then, pass the bot check and add your phone number. You will receive a code that you can input in the next screen.

How to Check if 2FA is Enabled on Github

To check if 2FA is Enabled on Github, go to Settings > Password and Authentication (under the Access section on the left) and see if the Preferred 2FA method is shown.

If not, you probably have the “Two-factor authentication is not enabled yet” message and should enable it.

Connect to Github From VS Code when 2FA is Enabled

When 2-Factor authentication is enabled, you need to follow extra steps to be able to connect to a repository from your remote. First, you need to set-up a personal access token (PAT) in Github developer settings and then configure your PAT in VS Code. The following steps explains how to connect VS Code to Github when 2FA is enabled.

What is the “[ACTION REQUIRED] Your GitHub account will soon require 2FA” Email?

By now, you have received the “[ACTION REQUIRED] Your GitHub account will soon require 2FA” email. This email means that you are part of a group of users that need to enable 2FA into their account.