{"meta":{"title":"Configuring two-factor authentication recovery methods","intro":"You can set up a variety of recovery methods to access your account if you lose your two-factor authentication credentials.","product":"Authentication","breadcrumbs":[{"href":"/en/authentication","title":"Authentication"},{"href":"/en/authentication/securing-your-account-with-two-factor-authentication-2fa","title":"Secure your account with 2FA"},{"href":"/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication-recovery-methods","title":"Configure 2FA recovery"}],"documentType":"article"},"body":"# Configuring two-factor authentication recovery methods\n\nYou can set up a variety of recovery methods to access your account if you lose your two-factor authentication credentials.\n\nIn addition to securely storing your two-factor authentication (2FA) recovery codes, we strongly recommend configuring two or more authentication methods to avoid losing access to your account. For more information, see [Configuring two-factor authentication](/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication#configuring-two-factor-authentication-using-a-security-key).\n\nAs well as configuring authentication methods, we'd also strongly suggest setting up some 2FA recovery methods which may be helpful if you were ever to lose your authentication methods. Recovery methods available to be configured include: the account's recovery codes file, SSH key(s), Personal access tokens (PATs) and verified device(s).\n\n## About the recovery codes file\n\nThe recovery codes file includes one-time codes for account recovery if you can’t access your two-factor authentication method. You should download and store these codes securely.\n\n### Downloading your two-factor authentication recovery codes\n\nWhen you configure two-factor authentication, you'll download and save your 2FA recovery codes. If you lose access to your phone, you can authenticate to GitHub using your recovery codes. You can also download your recovery codes at any point after enabling two-factor authentication.\n\nTo keep your account secure, don't share or distribute your recovery codes. We recommend saving them with a secure password manager.\n\nIf you generate new recovery codes or disable and re-enable 2FA, the recovery codes in your security settings automatically update. Reconfiguring your 2FA settings without disabling 2FA will not change your recovery codes.\n\n1. In the upper-right corner of any page on GitHub, click your profile picture, then click ** Settings**.\n2. In the \"Access\" section of the sidebar, click ** Password and authentication**.\n3. Next to \"Recovery codes,\" click **View**.\n\n \n4. Save your recovery codes in a safe place. Your recovery codes can help you get back into your account if you lose access.\n * To save your recovery codes on your device, click **Download**.\n * To save a hard copy of your recovery codes, click **Print**.\n * To copy your recovery codes for storage in a password manager, click **Copy**.\n\n### Generating a new set of recovery codes\n\nOnce you use a recovery code to regain access to your account, it cannot be reused. If you've used all 16 recovery codes, you can generate another list of codes. Generating a new set of recovery codes will invalidate any codes you previously generated.\n\n1. In the upper-right corner of any page on GitHub, click your profile picture, then click ** Settings**.\n2. In the \"Access\" section of the sidebar, click ** Password and authentication**.\n3. Next to \"Recovery codes,\" click **View**.\n\n \n4. Under \"Generate new recovery codes\", click **Generate new recovery codes**.\n\n### Configuring backups for your time-based one-time password (TOTP) app\n\nMost TOTP apps support backups. If you lose access to your authentication device, you can use your TOTP app backup to access your authentication method and account credentials on a different authentication device, ensuring continued access to your 2FA-enabled account.\n\nThe process of configuring backups is different for each TOTP app. For some examples from popular TOTP apps, see the following documentation:\n\n* [1Password](https://support.1password.com/backups/)\n* [Google Authenticator](https://security.googleblog.com/2023/04/google-authenticator-now-supports.html)\n* [Microsoft Authenticator](https://support.microsoft.com/en-us/account-billing/back-up-and-recover-account-credentials-in-the-authenticator-app-bb939936-7a8d-4e88-bc43-49bc1a700a40)\n\n## SSH keys\n\nSSH keys can be configured and used for account recovery if ever required. To set up 1 or more SSH keys that can be used to recover access to your 2FA-enabled account, see [Adding a new SSH key to your GitHub account](/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account).\n\n> \\[!NOTE]\n> Be sure to choose 'authentication' as the key's type during this process.\n\n## Personal access tokens\n\nPersonal access tokens (PATs) can be configured and used for recovery if ever needed. To set up 1 or more PATs that can be used to recover access, see [Managing your personal access tokens](/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic).\n\n> \\[!NOTE]\n> Be sure to choose 'repo' when choosing the 'scopes' available during this process.\n\n## Further reading\n\n* [About two-factor authentication](/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication)\n* [Configuring two-factor authentication](/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication)\n* [Accessing GitHub using two-factor authentication](/en/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication)\n* [Recovering your account if you lose your 2FA credentials](/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials)"}