GitHub Ends Password Authentication for Git Operations

GitHub has announced that starting August 13, 2021, password-based authentication will no longer be accepted for Git operations on GitHub.com. All authenticated Git commands must instead use token-based authentication—such as a personal access token, OAuth token, or GitHub App installation token—or an SSH key.

The change affects several common workflows:

  • Command line Git access
  • Desktop applications using Git (GitHub Desktop is not affected because it already uses token-based authentication)
  • Any app or service accessing Git repositories on GitHub.com directly with an account password

Who Is Unaffected

Some users will not need to take action:

  • Accounts with two-factor authentication (2FA) enabled already require token- or SSH-based authentication.
  • GitHub Enterprise Server users are unaffected; no changes have been announced for the on-premises product.
  • GitHub Apps are inherently unaffected because they do not support password authentication.

Why Tokens Replace Passwords

GitHub previously explained its rationale when making similar changes for API authentication, citing the security features it has added over the years—2FA, sign-in alerts, verified devices, compromised-password protection, and WebAuthn support. Despite those protections, users without 2FA have still been able to authenticate Git and API operations with just a username and password.

Token-based credentials offer distinct advantages over passwords:

  1. Unique – Tokens are specific to GitHub and can be generated per use or per device.
  2. Revocable – Tokens can be individually revoked at any time without affecting other credentials.
  3. Limited – Tokens can be narrowly scoped to allow only the access needed for a particular use case.
  4. Random – Tokens are not susceptible to the dictionary or brute-force attacks that simpler, memorable passwords are.

What Users and Integrators Need to Do

Developers currently using a password over HTTPS should switch to a personal access token or an SSH key before August 13, 2021. If a warning appears about an outdated third-party integration, updating the client to the latest version should resolve the issue.

Integrators must update their authentication to use the web or device authorization flows by the deadline. Details are available in GitHub's documentation on Authorizing OAuth Apps.

Enabling Two-Factor Authentication

Users who want to eliminate password-based authentication from their account immediately can enable two-factor authentication. Doing so forces all Git and third-party integration operations to use a personal access token.

Scheduled Brownouts

To prompt affected users to update before the final cutoff, GitHub will temporarily disable password authentication during two scheduled brownout periods. Git operations using passwords will fail during these windows:

June 30, 2021

  • 7:00 AM UTC – 10:00 AM UTC
  • 4:00 PM UTC – 7:00 PM UTC

July 28, 2021

  • 7:00 AM UTC – 10:00 AM UTC
  • 4:00 PM UTC – 7:00 PM UTC

Timeline

GitHub will be notifying affected users by email in advance. The sequence of events is:

  • Now – Emails go out to users still authenticating with passwords, urging them to update their authentication method or third-party client.
  • June 30 and July 28, 2021 – Brownouts temporarily require token (or SSH key) authentication for all Git operations.
  • August 13, 2021 – Token (or SSH key) authentication becomes mandatory for all authenticated Git operations.

Support resources include GitHub's earlier blog post on API password authentication changes, account security documentation, and GitHub Support. Security keys are also available through the GitHub Shop.