Skip to content
Novaz AuthenticatorGET

GitHub 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Is 2FA required on your account?
  2. Turn on 2FA with an authenticator app
  3. The 28-day check-up
  4. Your recovery codes
  5. When GitHub asks for a code
  6. If GitHub rejects your code
  7. Moving to a new iPhone
  8. If you lose your authenticator
  9. Turning 2FA off
  10. Official GitHub help

Your GitHub account is where your repositories, issues and pull requests live, and on it two-factor authentication (2FA) is often not your choice to make. Since March 2023, GitHub has required it for accounts that contribute code, and organizations can require it of their members. GitHub recommends an authenticator app, which its docs call a TOTP app, as your main method. Text messages are the only other way to start; passkeys, security keys and GitHub Mobile can be added afterwards (GitHub, GitHub). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the GitHub steps come from GitHub Docs and the GitHub Blog, linked below, which we read on October 20, 2026. We haven't tested them on a GitHub account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Is 2FA required on your account?

GitHub selects accounts by what they do: publishing an app or action, creating a release, owning an organization, or contributing to repositories that publish packages or that GitHub counts as high-importance. Selected accounts get an email and banners, and have 45 days to set up 2FA, plus a 7-day grace period. After that, GitHub.com is off limits until 2FA is on. Your company's single sign-on doesn't exempt you (GitHub).

You never have to give GitHub a phone number: an authenticator app is enough. It's also the only choice where GitHub doesn't offer text messages, and it counts as a secure method for organizations that allow only secure methods (GitHub).

Turn on 2FA with an authenticator app

The steps on GitHub.com (GitHub):

  1. Click your profile picture in the upper-right corner, then Settings.
  2. In the Access section of the sidebar, click Password and authentication.
  3. Under Two-factor authentication, click Enable two-factor authentication.
  4. Under Scan the QR code, GitHub shows a QR code. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  5. Can't scan it? Click setup key to see the secret as text. In Novaz, tap +, then Enter key manually, and type it as the Setup key. GitHub uses 6 digits, 30 seconds and SHA-1, so a typed key works. See What is a 2FA setup key?
  6. Type the code from Novaz under Verify the code from the app.
  7. Under Save your recovery codes, click Download, then I have saved my recovery codes. That click turns 2FA on.

The 28-day check-up

New 2FA setups start a 28-day check-up. Complete a 2FA sign-in in that time and it ends. If you don't, GitHub asks for 2FA in one of your open sessions on day 28 (GitHub). The point is to catch authenticator apps that were set up wrong. If you can't pass, GitHub offers a shortcut to set 2FA up again without being locked out (GitHub). The easy way through: sign out soon after setup and sign back in with a code from Novaz.

Your recovery codes

You get 16 single-use codes in the form xxxxx-yyyyy, saved by default as github-recovery-codes.txt (GitHub, GitHub). GitHub recommends authenticator apps that back up to the cloud (GitHub). With Novaz, that's iCloud backup (PRO). A backup file you export yourself works too, as long as you keep it up to date; without either, its keys are only on your iPhone. Keep these codes either way, for the day the phone is gone and the backup is missing or out of date. GitHub suggests a password manager for them.

Later, click View next to Recovery codes in Password and authentication to Download, Print or Copy them. Generate new recovery codes cancels the old set, and so does turning 2FA off and on. Switching authenticator apps doesn't (GitHub). See 2FA backup codes.

When GitHub asks for a code

GitHub asks for a code after your password when you sign in. It asks again only when you've signed out, use a new device, your session expires, or you do something sensitive (GitHub). Sensitive actions include changing an email address, adding an SSH key, creating a personal access token and viewing recovery codes. After one, GitHub doesn't ask again for two hours (GitHub).

Git on the command line never asks for the code: HTTPS uses a personal access token, and SSH works as before (GitHub).

If GitHub rejects your code

A wrong code shows Two-factor authentication failed. GitHub's checks: read the code from the app and the entry you set up, set your phone's date and time automatically, and type a fresh code straight away with no spaces (GitHub). On iPhone, that's Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.

The same page says GitHub Support "cannot assist with troubleshooting your 2FA methods" (GitHub). See Authenticator code not working?

Moving to a new iPhone

You don't need to turn 2FA off. In Password and authentication, under Two-factor methods, click Edit next to the authenticator app (with several methods, open the menu next to it first). Scan the new QR code with Novaz on the new iPhone, enter a code and click Save. Your recovery codes stay the same (GitHub). Only then remove GitHub from Novaz on the old iPhone: open it and tap Remove account. Do this before you give up the old one. If you have iCloud backup or a Novaz backup file, you can restore your accounts on the new iPhone instead, and the GitHub entry keeps working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

GitHub's options, in order (GitHub):

  1. Another method you added: passkey, security key, GitHub Mobile or text messages.
  2. A recovery code. After your password, choose 2FA recovery code under More options, type a code and click Verify.
  3. Account recovery. On that screen, choose Begin account or email recovery, then I understand, get started. Enter the one-time password GitHub emails you, then prove it's you with Verify with this device (if you've signed in on it before), SSH key or Personal access token. GitHub Support reviews the request and replies by email within three business days.

Forgot your password too? Start with a password reset; GitHub then offers the same options.

Option 3 only works if you prepared. GitHub suggests an SSH key added as an authentication key, or a classic personal access token with the repo scope (GitHub). Don't clear cookies daily: a cookie is how GitHub recognizes a device you've used before (GitHub).

If nothing works, the account is gone for good. Support won't restore it and doesn't accept ID checks (GitHub). You can still unlink your email address and use it on a new account. See Lost the phone with your authenticator app?

Turning 2FA off

In Password and authentication, open the three-dot menu, choose Disable two-factor authentication and confirm. You lose access to organizations that require 2FA, and if GitHub selected you for required 2FA, you can't turn it off at all (GitHub). To switch apps, edit the method instead.

Official GitHub help

More guides: Developer tools