Enable 2FA for both sign-in and write actions, add a security key if you can, and keep recovery codes somewhere other than your phone. npm documents two CLI modes, auth-and-writes and auth-only, and a recovery login starts a 72-hour hold on publishing.
The two modes
From the command line you can turn 2FA on in one of two modes. In the first, called auth-and-writes, npm asks for your second factor at sign-in and for write actions. In the second, auth-only, it covers authorization only.
The npm page does not spell out line by line which actions each mode protects, so check the "About two-factor authentication" page before relying on a detail. For a solo publisher the safe default is the broader mode, because publishing is a write action and you want that step to need a second factor.
npm profile enable-2fa auth-and-writes
Which second factor
npm supports security keys through WebAuthn. The docs say you can set them up only on the website, and that they work for sign-in on both the web and the command line. Built-in biometrics such as Touch ID, Face ID or Windows Hello count, as do physical keys. You need npm client 5.5.1 or later.
A key is harder to phish than a typed code, which matters because fake npm 2FA emails are a known lure aimed at maintainers.
Recovery codes for a one-person account
Solo publishers have no teammate who can vouch for them, so recovery planning matters more, not less. The npm docs say:
- You receive recovery codes when you set up 2FA.
- Store them somewhere other than your second-factor device, such as a password manager.
- Each code works once.
- You can view or regenerate codes in your 2FA settings.
- Signing in with a recovery code starts a 72-hour security hold. During it you cannot publish, create access tokens or change account settings.
- You can link a GitHub account as a secondary recovery option.
That hold is a feature. If an attacker got a code, they still could not push a release for three days. But it also means you should not plan a release for the day you lose your phone. Our post on maintainer recovery codes and backups goes deeper on storage.
A quick setup order
- Turn on 2FA with the broader mode.
- Add a security key on the website.
- Download the recovery codes and put them in a password manager that is not on the same phone.
- Regenerate the codes if you ever suspect they were exposed.
- Check that your publish path works: either 2FA on your account, or a granular token with bypass-2FA, which npm says overrides 2FA for actions such as publishing. Prefer trusted publishing for CI where you can.
Quick check
Can I remove 2FA later?
From the command line it needs your password and a 2FA prompt. If you belong to an organization that enforces 2FA, npm says you cannot remove it.
What happens if I log in with a recovery code?
The npm docs say a 72-hour security hold begins. You cannot publish, create access tokens or change account settings until it ends.
Sources
Last reviewed: 19 October 2026.
