Recovering your account if you lose your 2FA credentials

Using a two-factor authentication recovery code

Use one of your recovery codes to automatically regain entry into your account. You may have saved your recovery codes to a password manager or your computer's downloads folder. The default filename for recovery codes is github-recovery-codes.txt. For more information about recovery codes, see "Configuring two-factor authentication recovery methods."

1. Type your username and password to prompt authentication.
2. Under "Having Problems?", click Enter a two-factor recovery code.
3. Type one of your recovery codes, then click Verify.

Authenticating with a fallback number

If you lose access to your primary TOTP app or phone number, you can provide a two-factor authentication code sent to your fallback number to automatically regain access to your account.

Authenticating with a security key

If you configured two-factor authentication using a security key, you can use your security key as a secondary authentication method to automatically regain access to your account. For more information, see "Configuring two-factor authentication."

Authenticating with a verified device, SSH token, or personal access token

If you know your GitHub password but don't have the two-factor authentication credentials or your two-factor authentication recovery codes, you can have a one-time password sent to your verified email address to begin the verification process and regain access to your account.

You can use your two-factor authentication credentials or two-factor authentication recovery codes to regain access to your account anytime during the 3-5 day waiting period.

1. Type your username and password to prompt authentication. If you do not know your GitHub password, you will not be able to generate a one-time password.
2. Under "Having Problems?", click Can't access your two factor device or valid recovery codes?
3. Click I understand, get started to request a reset of your authentication settings.
4. Click Send one-time password to send a one-time password to all email addresses associated with your account.
5. Under "One-time password", type the temporary password from the recovery email GitHub sent.
6. Click Verify email address.
7. Choose an alternative verification factor.
   • If you've used your current device to log into this account before and would like to use the device for verification, click Verify with this device.
   • If you've previously set up an SSH key on this account and would like to use the SSH key for verification, click SSH key.
   • If you've previously set up a personal access token and would like to use the personal access token for verification, click Personal access token.
8. A member of GitHub Support will review your request and email you within 3-5 business days. If your request is approved, you'll receive a link to complete your account recovery process. If your request is denied, the email will include a way to contact support with any additional questions.

Authenticating with an account recovery token

If you lose access to the two-factor authentication methods for your account on GitHub.com, you can retrieve your account recovery token from a partner recovery provider and ask GitHub Support to review it.

If you don't have access to your two-factor authentication methods or recovery codes and you've stored an account recovery token with Facebook using Recover Accounts Elsewhere, you may be able to use your token to regain access to your account.

If you're unable to regain access to your account, generate a one-time password to regain access. For more information, see "Authenticating with a verified device, SSH token, or personal access token."

1. On Facebook, navigate to your Security Settings, then click Recover Accounts Elsewhere.
2. Click the recovery token associated with your account on GitHub.com.
3. To redeem your account recovery token, click Recover This Account. A new window will open, returning you to GitHub.
4. Contact GitHub Support to let them know that your account recovery token is ready for review.

Further reading

• "About two-factor authentication"
• "Configuring two-factor authentication"
• "Configuring two-factor authentication recovery methods"
• "Accessing GitHub using two-factor authentication"