Which 2FA method should open source maintainers use on GitHub?

GitHub recommends a TOTP authenticator app as the primary second factor and security keys as backups, rather than SMS. SMS can be intercepted and does not protect against phishing. For maintainers, whose accounts can publish code others install, a hardware key is the strongest option on offer.

The methods GitHub supports

• TOTP app: any authenticator app that generates a new code every few seconds.
• SMS: a code by text message. Carrier rates may apply.
• Security keys: WebAuthn hardware keys. Add them after setting up TOTP or SMS.
• GitHub Mobile: approve sign-ins through push notifications, using public-key cryptography instead of typed codes.
• Passkeys: sign in without typing a password, with one passkey satisfying both password and second factor. You must already have TOTP or SMS configured.

What GitHub recommends

GitHub's documentation says a TOTP app is more reliable than SMS, especially outside the United States. It suggests security keys as backups rather than SMS, because SMS can be intercepted and does not protect against phishing.

A practical ranking for maintainers

This ranking is my own reading of the guidance, not a GitHub ranking.

1. Security key plus a TOTP app as fallback. Hardware keys resist phishing in a way typed codes do not.
2. Passkeys on a device you control, with TOTP configured behind them.
3. TOTP app alone. Good and widely supported, but a convincing fake login page can still capture a code.
4. SMS. Better than nothing, worst of the supported options.

Why maintainers need more care

Several supply chain incidents have started with a maintainer account being taken over, which gives the attacker the ability to publish. Our write-up on how account takeovers happen is here: how package takeover via maintainer account compromise happens. Scorecard does not check maintainer 2FA, because that data is not public, so a good score tells you nothing about it.

Habits that matter

• Download recovery codes when you enable 2FA and store them somewhere secure and offline.
• Reconfigure, do not disable. GitHub advises changing settings rather than turning 2FA off, so you keep recovery codes and organization memberships.
• Use the same discipline on registries. Registry accounts, such as npm and PyPI, are separate from GitHub. npm recommends requiring two-factor authentication and disallowing tokens in package settings.
• Move releases to CI with trusted publishing, so a stolen laptop cannot publish. See npm vs PyPI trusted publishing.
• Enable secret scanning push protection, which GitHub documents as a way to stop pushes containing detected secrets.

Quick check

Sources

• GitHub: configuring two-factor authentication
• npm trusted publishing documentation
• GitHub: preventing data leaks
• OpenSSF Scorecard repository

Last reviewed: 19 October 2026.