Configuring two-factor authentication recovery methods

You can set up a variety of recovery methods to access your account if you lose your two-factor authentication credentials.

In addition to securely storing your two-factor authentication recovery codes, we strongly recommend configuring one or more additional recovery methods.

Downloading your two-factor authentication recovery codes

When you configure two-factor authentication, you'll download and save your 2FA recovery codes. If you lose access to your phone, you can authenticate to GitHub Enterprise Cloud using your recovery codes. You can also download your recovery codes at any point after enabling two-factor authentication.

To keep your account secure, don't share or distribute your recovery codes. We recommend saving them with a secure password manager, such as:

If you generate new recovery codes or disable and re-enable 2FA, the recovery codes in your security settings automatically update.

  1. In the upper-right corner of any page, click your profile photo, then click Settings. Settings icon in the user bar
  2. In the left sidebar, click Account security. User account security settings
  3. Next to "Recovery codes," click Show. Show recovery codes button
  4. Save your recovery codes in a safe place. Your recovery codes can help you get back into your account if you lose access.
    • To save your recovery codes on your device, click Download.
    • To save a hard copy of your recovery codes, click Print.
    • To copy your recovery codes for storage in a password manager, click Copy. List of recovery codes with option to download, print, or copy the codes

Generating a new set of recovery codes

Once you use a recovery code to regain access to your account, it cannot be reused. If you've used all 16 recovery codes, you can generate another list of codes. Generating a new set of recovery codes will invalidate any codes you previously generated.

  1. In the upper-right corner of any page, click your profile photo, then click Settings. Settings icon in the user bar
  2. In the left sidebar, click Account security. User account security settings
  3. Next to "Recovery codes," click Show. Show recovery codes button
  4. To create another batch of recovery codes, click Generate new recovery codes. Generate new recovery codes button

Configuring a security key as an additional two-factor authentication method

You can set up a security key as a secondary two-factor authentication method, and use the security key to regain access to your account. For more information, see "Configuring two-factor authentication."

Setting a fallback authentication number

You can provide a second number for a fallback device. If you lose access to both your primary device and your recovery codes, a backup SMS number can get you back in to your account.

You can use a fallback number regardless of whether you've configured authentication via text message or TOTP mobile application.

Warning: Using a fallback number is a last resort. We recommend configuring additional recovery methods if you set a fallback authentication number.

  1. In the upper-right corner of any page, click your profile photo, then click Settings. Settings icon in the user bar
  2. In the left sidebar, click Account security. User account security settings
  3. Next to "Fallback SMS number", click Add. Add fallback SMS number button
  4. Under "Fallback SMS number", click Add fallback SMS number. Add fallback SMS number text
  5. Select your country code and type your mobile phone number, including the area code. When your information is correct, click Set fallback. Set fallback SMS number

After setup, the backup device will receive a confirmation SMS.

Further reading

Did this doc help you?

Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Or, learn how to contribute.