Yes, but neither control is a complete repository-security boundary. GitHub passkeys and two-factor authentication (2FA) make a stolen password insufficient for a new interactive sign-in. Passkeys provide the strongest protection discussed here because WebAuthn authentication is bound to the GitHub.com domain and is highly resistant to phishing. TOTP and SMS codes still improve security over password-only access, but an attacker can phish or relay them. Existing sessions, personal access tokens, SSH private keys, OAuth authorizations, GitHub Apps, compromised devices, weak recovery, and excessive permissions can still lead to repository compromise after 2FA is enabled.
What passkeys and 2FA actually protect
These controls primarily protect the sign-in event: proving that the person entering a GitHub account is authorized to use it. Without a second factor, a criminal who obtains your password can usually sign in immediately. With 2FA enabled, that password alone should not complete authentication. With a passkey, the browser or security key proves possession of a private cryptographic key registered to GitHub.
As an Amazon Associate I earn from qualifying purchases.
GitHub’s current Enterprise Cloud documentation describes passkeys as credentials bound to a website domain such as GitHub.com. They require a secure connection, so a browser will not complete the same authentication ceremony on a lookalike phishing domain. This domain binding is why passkeys are considered highly phishing-resistant, unlike SMS and TOTP codes, which can be entered into a convincing fake login page and relayed to GitHub.
GitHub also states that passkeys satisfy both the password and 2FA requirements. A passkey can therefore replace the password-plus-second-factor sequence for sign-in and, in the documented recovery flow, you do not need to know the account password to recover access with a valid passkey. That convenience does not remove the need for backup recovery methods: losing every enrolled authenticator can still leave you locked out.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
GitHub does not publish a controlled percentage reduction in repository account-takeover risk for passkeys or 2FA. The evidence supports a qualitative conclusion: they materially reduce attacks that depend on a stolen password, while leaving other credential and authorization paths in scope.
Passkeys, TOTP and SMS: how the protections differ
| Method | Protection against phishing | What an attacker would still need | Operational consideration |
|---|---|---|---|
| Passkey or FIDO2/WebAuthn security key | Strongest option here. The credential is domain-scoped and uses public-key cryptography. | Access to the enrolled device or key, or another surviving recovery method. | Enroll a second authenticator and protect recovery codes; losing the only device can cause lockout. |
| TOTP authenticator app | Better than password-only access, but the one-time code can be phished or relayed in real time. | The password and the current code, or access to the authenticator backup. | Secure the authenticator seed and recovery codes separately from the account password. |
| SMS 2FA | Adds a second channel but remains phishable and depends on the phone-number ecosystem. | The password and control of the phone number or intercepted message. | Use a stronger factor when possible; treat the phone number as a recovery dependency. |
| Password only | No second-factor protection. | The password alone. | Not an appropriate baseline for an account that can write to important repositories. |
A hardware FIDO2 key is a passkey implementation designed to keep the private key in a dedicated device. A device-backed passkey stored by a supported operating system can provide the same phishing-resistant protocol, but availability, synchronization and recovery behavior depend on that device ecosystem. In either case, register a second authenticator before you need it.
How a passkey stops someone who stole your password
- The attacker obtains your GitHub password, perhaps through a reused password or a data breach.
- They open the genuine GitHub sign-in page and enter that password.
- GitHub requests the registered passkey. The authenticator creates a cryptographic response for the real GitHub origin; it does not reveal the private key.
- If the attacker is on a phishing domain, the browser will not produce a valid response for GitHub’s domain. The stolen password therefore does not complete the sign-in.
This protection assumes the attacker does not also control an authenticated session, a registered authenticator, a usable recovery method, or another credential with repository access. Passkeys prevent a particular class of login attack; they do not retroactively invalidate credentials that were already stolen.
Recommended Free Tools
Can someone still push code when 2FA is enabled?
Yes. 2FA protects account authentication, not every way GitHub can accept an authenticated request. A criminal may still push code through any of these paths:
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Existing browser sessions: a stolen session cookie can allow actions without repeating the login challenge until the session is revoked or expires.
- Personal access tokens: a token can authorize Git operations and API calls according to its scopes, without presenting your interactive 2FA prompt.
- SSH keys: possession of the private half of an SSH key lets an attacker impersonate its owner and push wherever that identity has write permission. The key may remain usable even after you change the account password.
- Deploy keys: a repository-specific key can continue to work until it is removed, even if the account used to create it is secured.
- OAuth authorizations and GitHub Apps: a malicious or over-permissioned integration can act through its granted permissions.
- Compromised devices: malware can capture sessions, tokens or files containing private keys after a successful 2FA login.
- Excessive repository or organization permissions: another collaborator, bot or service account may have write access independent of your personal 2FA status.
For that reason, an account with 2FA can still be the starting point for repository compromise if any long-lived credential or integration remains active.
Recovery is part of the security boundary
GitHub lists recovery codes, SSH keys, personal access tokens, verified devices and passkeys among possible recovery methods. Each is effectively a high-value credential. A recovery plan that is easier to use than normal login can become the attacker’s preferred path.
Store recovery codes safely
Generate GitHub recovery codes and keep them in a reputable password manager or an offline protected location. Do not store the only copy in the same account, browser profile or device that could be compromised. Treat each code as single-use and replace the set if it is exposed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsKeep more than one authenticator
Enroll two independent passkeys, such as a primary device-backed passkey and a separate FIDO2 security key, or two separately controlled hardware keys. Test that the backup works while you are still signed in. Do not remove the original authenticator until the replacement and recovery codes have been verified.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Plan for loss or theft
If a device or security key disappears, remove that passkey from GitHub as soon as practical and revoke associated sessions and credentials. If you lose every passkey and your recovery material, GitHub’s available recovery options may include a verified device, an SSH key or a personal access token, but access is not guaranteed. Maintaining multiple factors is safer than relying on an emergency support process.
Set up a phishing-resistant GitHub sign-in
GitHub’s labels can vary slightly between personal accounts and organization-managed accounts, but the normal account path is:
- Sign in to GitHub.com and open your profile menu.
- Choose Settings, then Password and authentication.
- In the passkey or security-key area, choose the option to add a new passkey or security key.
- Complete the device prompt, PIN or biometric verification. The private key remains in the authenticator.
- Give the credential a recognizable name, such as the device or key location, so you can identify it later.
- Add a second authenticator, then generate and securely store recovery codes.
- Sign out in a separate browser window and test both the primary and backup methods before relying on them.
If a passkey is unavailable, enable 2FA and select an authenticator-app method rather than treating SMS as equivalent. TOTP is still vulnerable to real-time phishing, but it is generally a stronger default than SMS when a passkey cannot be used.
Audit every credential after enabling 2FA
Turning on 2FA does not remove old access. Perform an inventory of the account and each repository you can administer:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Remove unknown or obsolete SSH keys and deploy keys.
- Revoke personal access tokens that are unused, unexpectedly broad or stored in places you no longer control. Create narrowly scoped replacements with expiration where the workflow permits.
- Review OAuth authorizations and GitHub App installations. Remove integrations you do not recognize and reduce permissions for those you still need.
- Inspect webhooks, collaborators, outside collaborators and organization membership for unexpected changes.
- Review GitHub’s security log for unfamiliar sign-ins, key additions, token creation, permission changes and repository events.
- Check recent commits, releases and workflow-file changes for unauthorized activity.
Do this audit after routine enrollment and repeat it when a device is lost, a team member leaves, an integration changes ownership or a credential may have been exposed.
Protect the main branch separately
Authentication controls cannot guarantee that an authorized identity will make a safe change. Configure branch protection for critical branches so a stolen credential has fewer ways to alter production code.
- Require pull requests and a defined number of approving reviews.
- Require status checks to pass before merging.
- Require conversation resolution where your review process depends on it.
- Require signed commits if your team verifies commit provenance.
- Restrict who can push directly to the branch.
- Disable force pushes and branch deletion for critical branches.
These rules do not make a compromised account harmless: an attacker may still open a pull request, target an unprotected branch or abuse a workflow. They do, however, create review and automation gates that can limit the blast radius.
Reduce organization and automation exposure
Enforce stronger member authentication
GitHub identifies weak or compromised authentication as a common cause of account takeover. Organization owners should require 2FA for members and use single sign-on (SSO) where available. Remove dormant accounts and review who can create repositories, install applications, manage webhooks or change branch rules.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Review application access
OAuth applications and GitHub Apps should receive only the permissions required for their task. Recheck installations when an integration changes vendor, ownership or purpose. A legitimate application with excessive write access can be as damaging as a stolen personal token.
Constrain GitHub Actions
Review workflow permissions and reduce the default GITHUB_TOKEN rights to the minimum needed. Prefer read-only permissions for jobs that only build or test, grant write access to narrowly defined jobs, and keep deployment secrets out of pull requests from untrusted branches. Treat workflow-file changes as privileged code because they can expose secrets or modify release behavior.
What to do if you suspect an account takeover
- Change the GitHub password from a known-clean device, even if the attacker may have used a token or key.
- Revoke unfamiliar sessions, personal access tokens, OAuth authorizations and GitHub App access.
- Remove unknown passkeys, SSH keys and deploy keys. Rotate any legitimate key or secret that may have been copied.
- Inspect the security log, recent commits, releases, workflow files, collaborators, webhooks and repository visibility.
- Check organization membership and SSO-linked access for unauthorized changes.
- Restore malicious commits or configuration only after preserving evidence and understanding how the attacker entered.
- Review branch protections and automation permissions before returning normal write access.
An attacker with an SSH private key can continue to impersonate its owner until that key is revoked, so changing only the password is insufficient. The same principle applies to tokens and application credentials.
Quick Recap
Choosing the right baseline
- For an individual maintainer: use a passkey, enroll a second authenticator, store recovery codes securely, and audit tokens and SSH keys.
- For a team: require 2FA, prefer passkeys or FIDO2 keys for administrators, enforce least privilege, and protect the main branch with reviews and status checks.
- For an organization with automation: add SSO where available, inventory every app and webhook, minimize
GITHUB_TOKENpermissions and rotate secrets when personnel or integrations change. - When a passkey is not yet practical: use TOTP rather than password-only access, understand that codes remain phishable, and prioritize a migration to a phishing-resistant authenticator.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
