Loading page
About this tool
Weighted 15-step checklist for GitHub 2FA, recovery codes, passkeys, token and SSH key hygiene, and secret-scanning push protection.
This guide is a weighted, 15-control checklist covering GitHub two-factor authentication and the developer-specific controls around it: recovery codes, passkeys, personal access token hygiene, SSH key cleanup, commit signing and secret-scanning push protection. GitHub already requires 2FA from accounts that contribute code on github.com, so the value here is in the rest: the tokens, keys and app grants that quietly keep push access to your repositories. Four controls are marked critical and the score is held at 69% until all four are done.
Open GitHub 2FA Setup Guide on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Personal access tokens and SSH keys bypass your password entirely, so they are scored alongside the second factor.
The checklist separates codes you can be tricked into typing from passkeys and security keys, which are bound to github.com.
No sign-in, no token, no account data leaves your browser; the page only tracks which boxes you ticked.
Yes for accounts that contribute code on github.com. GitHub rolled out a requirement covering all such users, so an account that has not enrolled is eventually restricted until it does. Enterprise and organisation owners can also enforce 2FA for every member of their organisation.
GitHub generates 16 single-use recovery codes when you enable two-factor authentication and lets you download, print or copy them. Store them outside GitHub itself, such as in a password manager or on paper, and generate a fresh set from Settings > Password and authentication if you ever use or expose them.
A classic token carries broad scopes across every repository you can reach and can be set to never expire. A fine-grained token is restricted to chosen repositories with per-permission access and has a maximum lifetime of 366 days, which limits both the blast radius and the shelf life if it leaks.
Not on its own. SSH keys, deploy keys and personal access tokens authenticate without a second factor by design, so a stolen key or token still allows a push. That is why the checklist weights the token and SSH audit alongside the login controls.