Protect Your GitHub Account with Only a Password: How to Set Up 2FA and a Security Key

The account of a developer who uses a GitHub account does not only store code.

Via account:

• Private warehouses

• Codes

• GitHub Actions

• Personal access tokens

• Application access

• Business projects

can be accessed.

Therefore, it is important to use an additional layer of security on the GitHub account.

According to GitHub's current documentation, two-factor authentication means 2FA. GitHub also recommends TOTP as the primary method, while adding the passkey or security key as a backup method.

How to turn on 2FA on GitHub?

First, log in to your GitHub account.

Then:

1. Click your profile photo in the top right.

2. Settings section.

3. Password and authentication.

4. Set up the appropriate method in the two-factor authentication section.

TOTP-based authentication and other methods are supported in detail in GitHub's current documentation.

What is TOTP?

TOTP is a one-time code system that the authentication application on your phone generates at regular intervals.

When logging in:

Password + verification code

.

What is a security key?

A physical security key adds a second layer of verification to your account with a physical device.

According to GitHub's documentation, WebAuthn compatible security keys can be registered as a second factor.

Are passkey and security key the same thing?

No.

GitHub's documentation distinguishes these two methods.

The security key can be used as a second factor as a WebAuthn credential.

Passkey can meet both password and 2FA requirements in one step in supported scenarios.

How to add passkey to GitHub?

On GitHub:

1. Click your profile photo.

2. Settings.

3. Password and authentication section.

4. Passkeys.

5. Add a passkey.

6. If the system asks for verification, verify with your current authentication method.

7. Complete the Passkey provider's instructions.

Platform authenticators such as Windows Hello, Face ID or Touch ID can also be registered as passkeys.

Don't forget recovery codes

This section is very important.

If you lose access to your account after turning on 2FA, you may need an alternative recovery method.

GitHub's security key installation documentation specifically states that recovery codes should be downloaded and stored in a safe place.

Recovery codes:

• To a public folder

• To GitHub repository

• To code file

• To publicly accessible cloud folder

do not place.

What is the most logical security scheme?

Based on GitHub's current recommendation:

TOTP app → main 2FA method

Passkey or security key → backup method

can be established.

Why should you not rely on SMS?

GitHub notes that SMS is available in many countries, but carries certain security risks.

Therefore, it makes sense to consider stronger verification options, especially for accounts with serious software projects.