GitHub Reports Early Returns on Mandatory 2FA Rollout

GitHub has published the first set of results from its 2023 initiative to require two-factor authentication (2FA) for developers who contribute code to GitHub.com. The company’s goal was to close the most obvious hole in the software supply chain: the accounts of the people writing the code. The data shows a substantial increase in adoption, a shift toward stronger authentication methods, and—contrary to typical expectations—a decrease in related support burden.

Adoption Numbers and the Push Toward Passkeys

Beginning in March 2023, GitHub gradually mandated 2FA for specific user groups, prioritizing those whose privileges or actions had the most impact on the software ecosystem. Among the code contributors who received the requirement in 2023, the opt-in rate has reached nearly 95%. Across all active contributors on the platform—a group that includes users making contributions like issue comments that don’t meet the 2FA requirement threshold—adoption of 2FA has increased by 54%.

Graph showing the upward trend of total registered 2FA users from May 2023 to March 2024.

A central part of the strategy was steering users toward more secure authentication factors, particularly passkeys, which GitHub introduced to public beta in July 2023. Since then, nearly 1.4 million passkeys have been registered on GitHub.com. Usage data shows passkeys quickly became the dominant WebAuthn-backed 2FA method in daily use.

Graph showing Webauthn authentication success by type (passkey versus other) from July 2023 to March 2024. Passkeys surpassed all other types in November 2023, and the gap has widened since then.

GitHub still supports SMS as a second factor for users who lack access to other technologies, but the onboarding flow is designed to encourage stronger alternatives. That design work reduced the overall share of SMS as a second factor by almost 25% between early 2023 and early 2024. The company’s stated goal is to make passkeys the first choice for most developers.

The improved enrollment experience also appears to be encouraging users to hedge against lockout. GitHub reports that users are now 47% more likely to configure two or more forms of 2FA. Each additional factor reduces the chance that a user will lose access to all their credentials and require an account recovery process.

Graph showing the number of users with 2 or more 2FA methods from April 2023 to March 2024. The line began trending rapidly upward in November 2023, becoming almost exponential in early 2024.

Support Volume Drops Despite Higher Enrollment

A mandatory security rollout would normally be expected to flood the support queue. GitHub saw the opposite. By investing in refined 2FA onboarding flows, adding GitHub Mobile 2FA, and expanding the number of primary factors a user could select, the company cut 2FA-related support tickets by one-third.

Operational changes also reduced the load on human agents. Through workflow automation and optimized internal processes, 2FA account recovery tickets requiring significant human intervention fell by 54%. More importantly, over 75% of account recovery requests now originate from the in-product workflow, which automatically validates known-safe scenarios and risk factors before a ticket reaches a human.

Graph comparing 2FA account recovery tickets with tickets involving automated review from May 2023 to March 2024. The line representing automated review surpassed the line representing account recovery tickets around October 2023 and has stayed there ever since.

GitHub also points to a 2FA verification checkup that runs 28 days after initial setup. This checkup acts as a fail-safe, giving users a chance to confirm their configuration is working. It helped 25% of users successfully reconfigure their accounts after a mistake or a lost factor, preventing what would have otherwise been a lockout and a subsequent support ticket.

Screenshot of the dialog box prompting a user to verify their 2FA settings.

Ecosystem Role and Unfinished Work

GitHub has been transparent about its rollout methodology, partly to encourage other organizations to adopt similar mandates. The effort has had company: RubyGems, PyPI, and AWS have all announced their own 2FA or MFA requirements for their platforms over the last two years.

The 2023 enrollment effort did not cover every GitHub.com user. The company prioritized distinct user groups and notes that its enrollment criteria is not designed to cover all users. There remains industry-wide work to accommodate users who lack access to a phone or who don’t control the software on their computers. GitHub says it is evaluating how to expand mandatory 2FA enrollment to more users during 2024.

The roadmap also includes investigations into session and token binding, features that would help developers and organizations manage account compromise risk independently of 2FA. GitHub continues to drive adoption of its most secure factors—passkeys and security keys—and plans to focus on helping users “move up” to stronger authenticator types.

The central takeaway from the data is aimed at other platforms: large-scale security requirements don’t have to degrade the user experience if the onboarding design is done right. GitHub’s results suggest that the barrier to meaningfully raising security standards across the software supply chain is lower than many organizations assume.