Why GitHub is starting to enforce 2FA
GitHub is moving from urging developers to adopt two-factor authentication (2FA) to requiring it. The company has already enforced 2FA for maintainers of high-impact npm packages, those with more than 1 million weekly downloads or over 500 dependents, and now plans to extend this requirement to every developer who contributes code on GitHub.com. The rollout begins in March 2023 and is expected to reach all qualifying users by the end of the year.
Because the mandate reaches millions of users, GitHub plans a gradual rollout across distinct user groups. By phasing the requirement, the company says it can evaluate how well developers onboard to 2FA, track account lockout and recovery rates, and monitor support ticket volume before expanding the mandate to larger audiences. The assignment of users to specific groups will not be publicized, but the criteria center on those with the widest impact on ecosystem security.
Which developers will see the 2FA requirement first
Users will qualify for early 2FA enablement based on their activity and access on GitHub.com, with an emphasis on accounts that could affect the broader software ecosystem:
- Publishers of GitHub or OAuth apps or packages
- Users who created a release
- Enterprise and organization administrators
- Contributors to repositories designated critical by npm, OpenSSF, PyPI, or RubyGems
- Contributors to roughly the top four million public and private repositories
How the enforcement window works
The rollout is designed to minimize lost productivity and avoid surprise account lockouts. GitHub’s process runs through three stages.
Advance notice and reminders
Affected users get an email approximately 45 days before their deadline, with instructions on enabling 2FA. During that period, announcement banners will appear at the top of GitHub.com, and occasional reminder emails will follow, each linking to the 2FA onboarding flow.
After the deadline: daily prompts, then a hard stop
Once a user’s enablement deadline passes, GitHub.com will ask them to turn on 2FA at first sign-in each day. That prompt can be dismissed once per day for up to one week, but after the week expires the user will be blocked from GitHub.com features until they enable 2FA. The snooze window only begins after a user signs in post-deadline, so a developer returning from an extended absence will not face a stale lockout.
Post-enrollment verification
Twenty-eight days after enabling 2FA, users receive a 2FA check-up within GitHub.com validating that the setup works. This provides a chance to reconfigure second factors or recovery codes that were misconfigured or lost during onboarding.
What comes next
GitHub says recent work has focused on improving the 2FA setup flow and account recovery processes, with additional refinements to recovery expected in the first half of 2023. The company is also preparing passkey support as a way to streamline strong authentication. Developers who want to switch on 2FA ahead of their assignment can follow the setup guidance from the initial announcement.
