Keeping your account and data secure
To protect your personal information, you should keep both your account on GitHub and any associated data secure.
About authentication to GitHub
You can securely access your account's resources by authenticating to GitHub, using different credentials depending on where you authenticate.
Creating a strong password
Secure your account on GitHub with a strong and unique password using a password manager.
Switching between accounts
Learn how to switch between multiple GitHub accounts and managed user accounts.
Verifying new devices when signing in
When you sign in for the first time from a new or unrecognized device without two-factor authentication enabled, GitHub may ask for additional verification to confirm that it is you.
Updating your GitHub access credentials
GitHub credentials include not only your password, but also the access tokens, SSH keys, and application API tokens you use to communicate with GitHub. Should you have the need, you can reset all of these access credentials yourself.
Managing your personal access tokens
You can use a personal access token in place of a password when authenticating to GitHub in the command line or with the API.
Reviewing your SSH keys
To keep your credentials secure, you should regularly audit your SSH keys, deploy keys, and review authorized applications that access your account.
Reviewing your deploy keys
You should review deploy keys to ensure that there aren't any unauthorized (or possibly compromised) keys. You can also approve existing deploy keys that are valid.
Token expiration and revocation
Your tokens can expire and can also be revoked by you, applications you have authorized, and GitHub itself.
Reviewing your security log
You can review the security log for your personal account to better understand actions you've performed and actions others have performed that involve you.
Security log events
Learn about security log events recorded for your personal account.
Removing sensitive data from a repository
If you commit sensitive data into a Git repository, you can remove it from the history.
About anonymized URLs
If you upload an image or video to GitHub, the URL of the image or video will be modified so your information is not trackable.
About GitHub's IP addresses
GitHub serves applications from multiple IP address ranges, which are available using the API.
GitHub's SSH key fingerprints
Public key fingerprints can be used to validate a connection to a remote server.
Sudo mode
To confirm access to your account before you perform a potentially sensitive action, GitHub.com prompts for authentication.
Preventing unauthorized access
You may be alerted to a security incident in the media, such as the discovery of the Heartbleed bug, or your computer could be stolen while you're signed in to GitHub. In such cases, changing your password prevents any unintended future access to your account and projects.
Viewing and managing your sessions
You can view and revoke your active sessions in your settings.