Maintainer account recovery: codes, backups and what to store where

Set up recovery the day you turn on two-factor authentication: download your recovery codes, store them in a password manager, register a second method, and know which other recovery options your account supports. The goal is to avoid two failures at once, being locked out and having your backups stolen.

Why maintainers should care more than most

A maintainer account can publish code that thousands of people install. Two-factor authentication guards it, but if your phone breaks the day before a security release, the same control now blocks you. Recovery planning keeps the lock from becoming a trap.

What GitHub provides

GitHub's recovery documentation describes:

• Recovery codes. One-time codes for when you cannot use your second factor. You can view, download, print or copy them from Settings, under Password and authentication, at any time after enabling 2FA. Each works once, and generating a new set invalidates the old.
• Other recovery methods. The page lists SSH keys, personal access tokens, verified devices, and TOTP app backups, with setup varying by app.
• A strong recommendation to have more than one method so you do not lose account access.

Details differ by service, so read your registry's own recovery rules too, for example for npm or PyPI.

Where to store the codes

• A password manager is the place GitHub suggests. Use one protected by a strong passphrase and its own second factor.
• Not in the repository, not in a shared document, not in chat.
• A printed copy in a safe place can work as a last resort, if you can keep it physically secure.

Do not distribute your codes to others, which GitHub specifically warns against.

A minimum recovery kit

1. Recovery codes, stored in a password manager.
2. A second registered security key or device, kept somewhere different from the first.
3. A recovery email address you control and that has strong protection itself.
4. A note of which services use which method, so you know what to check after a lost device.

If you use hardware keys, see ranking maintainer 2FA methods for the trade-offs.

Test it, once

Recovery you have never used is a hope. Pick a low-stakes moment, confirm you can find a code, and that the second key works. Then regenerate if you consumed one. Note that disabling and re-enabling 2FA updates your recovery codes, while reconfiguring without disabling does not.

Plan for the worst day

If you are ever incapacitated, a project may be stuck with your registry account. A trusted co-maintainer with their own access is the best answer. See succession for sole maintainers.

Quick check

Sources

• Configuring two-factor authentication recovery methods (GitHub Docs)

Last reviewed: 19 October 2026.