GitHub’s password deadline has passed

As of August 13, 2021, GitHub no longer accepts account passwords for authenticated Git operations. That change, announced back in December, means any developer pushing or pulling over HTTPS must now use a strong authentication factor: a personal access token, an SSH key, or, for integrators, an OAuth or GitHub App installation token.

The shift is part of a broader push to eliminate the weakest link in account security. GitHub has been building toward this with features like verified devices, compromised-password screening, WebAuthn support, and security keys for SSH Git operations.

Setting up two-factor authentication

If you haven’t yet enabled 2FA on your GitHub account, now is the time. Multifactor authentication is one of the most effective defenses against credential theft and phishing. GitHub offers several options:

  • Physical security keys such as YubiKeys
  • Platform authenticators built into personal devices—Windows Hello, Face ID, or Touch ID, all of which support WebAuthn
  • Time-based One-Time Password (TOTP) authenticator apps
  • SMS-based codes

SMS is available, but GitHub strongly recommends against it. SMS-based 2FA does not provide the same level of protection and is no longer recommended under NIST 800-63B. The most secure widely available methods are those based on the WebAuthn standard: physical security keys and platform authenticators like Windows Hello or Face ID/Touch ID. GitHub has backed WebAuthn early and continues to invest in it.

Signing commits with a security key

Once your account is secured with a security key, you can extend that protection to your work. GitHub supports digitally signing Git commits using a GPG key stored on a security key. For YubiKey users, there is a detailed configuration guide covering both commit verification and SSH authentication. Yubico has also produced a step-by-step video walkthrough for enabling security keys for SSH keys and commit signing.

Branded YubiKeys are back

In 2015, GitHub marked its adoption of Universal 2nd Factor authentication by offering GitHub-branded YubiKeys. Another batch is now available in partnership with Yubico: the YubiKey 5 NFC and YubiKey 5C NFC, both available from The GitHub Shop while supplies last.