GitHub shows the text key one click below the QR code, issues standard SHA-1 TOTP, and hands out 16 recovery codes exactly once.
Service github.comAlgorithm SHA-1Step 30sDigits 6
or drop an image here
Advanced
Waiting for a keypaste one above to start27
——————
Where GitHub hides the key
Profile menu → Settings → Password and authentication.
Under Two-factor authentication, click Enable two-factor authentication.
GitHub shows a QR code. Directly beneath it: “enter this text code”. Click that.
A 32-character Base32 string appears in four-character groups. Copy all of it; the spaces do not matter.
Paste it above and type the six digits back into GitHub.
Recovery codesGitHub shows 16 recovery codes once. Download them and keep them somewhere other than the machine you sign in from. Skipping this screen is how most lockouts start.
Parameters GitHub issues
Algorithm
SHA-1, the RFC 6238 default.
Period
30 seconds
Digits
6
URI format
otpauth://totp/GitHub:you@github.com?secret=…&issuer=GitHub. Paste the whole URI above and the label fills itself in.
git stops accepting your password
Once 2FA is enabled, git push over HTTPS no longer takes your account password. Three ways forward:
Personal access token. Settings → Developer settings → Tokens. Use it where git asks for a password.
SSH key. Unaffected by 2FA, nothing to change.
GitHub CLI.gh auth login runs its own browser flow and stores the credential for git.
If the key is gone
You have a recovery code. Use it at the 2FA prompt, then re-enroll immediately.
You are still signed in somewhere. Re-enroll from that session. The window closes when the session expires.
Neither. GitHub’s account recovery flow takes days and can fail. Organisation-owned accounts may be recoverable by an owner; personal accounts often are not.
Questions
What TOTP parameters does GitHub use?
Standard TOTP: HMAC-SHA-1, a 30-second step and 6 digits. Any RFC 6238 authenticator works.
Can I use this and my phone app at the same time?
Yes. TOTP has no registration step; anything holding the same secret generates the same code. Enroll the phone from the QR and keep the text key in your password manager for desktop.