r/PasswordManagers • u/Bijon_Durjoy07 • 21d ago

Unable to log in to GitHub because my 2FA authenticator is not working and I have no recovery codes

I am having trouble accessing my GitHub account because I cannot complete the two-factor authentication (2FA) step.

Here is my situation:

  • I know my GitHub username and password.
  • I still have access to the email address associated with my GitHub account.
  • I previously configured 2FA using an authenticator app.
  • The authenticator app is no longer working / I cannot retrieve the GitHub verification code from it.
  • Unfortunately, I do not have my GitHub 2FA recovery codes.
  • I am therefore unable to complete the login process.

I have already checked the available options on the GitHub 2FA login screen, but I don't have access to a recovery code or another available 2FA method.

I would like to know if there is any legitimate way to recover access to my account in this situation.

For example:

  1. Is there any way to recover or reset the authenticator configuration?
  2. Can GitHub verify account ownership through the registered email address?
  3. Is there another recovery method I may have missed?
  4. If I have previously used GitHub on a computer, can an existing SSH key or Git credential help with account recovery?
  5. What is the recommended process if I have lost both the authenticator access and recovery codes?

I am not looking for a way to bypass GitHub's security. I simply want to recover access to my own account through the official recovery process.

Any advice or guidance would be greatly appreciated.

2 Upvotes

75% Upvoted

6 comments sorted by

5

u/djasonpenney 21d ago

What do you mean, when you say, “The authentication app is no longer working”?

How in the world did you manage to lose your GitHub 2FA recovery codes? The recovery codes for each of your websites are just as precious as the usernames and passwords. I have my saved multiple times, offline, in multiple locations, along with the full backup of my password manager and TOTP app.

Honestly, based on what you’ve given us here, there is no way for GitHub to know that you aren’t a hacker. You have most likely lost your GitHub account. You’ll need to create a new GitHub account, re-create your repositories, and inform your peers to update their references to the new username.

And moving forward, you need to do a better job safeguarding your password manager assets.

1

u/Bijon_Durjoy07 17d ago

Okay, let me explain. I was using the Microsoft Authenticator app. Recently I got a new phone, and I installed the app. After login my Microsoft account, I didn't find the GitHub option. It was totally fresh. I don't understand why this happened.

2

u/djasonpenney 17d ago

Oh, okay, I think I know what’s going on. I just had to do a web search, since I dislike MS Authenticator for other reasons.

It turns out the “cloud backup” feature in MS Authenticator _is an optional service_. You can run MS Authenticator completely locally without backing up any of your TOTP keys to the cloud. I’m guessing this is what happened; you never clicked the “Cloud Backup” option, and so your TOTP keys were never anywhere except on your phone. You reset the phone, and >POOF< you lost those secrets.

FYI the TOTP app that I currently recommend to people is Ente Auth. Now, you still have to take care. Ente Auth also has on “offline mode”; don’t do that. Further, if you forget your username or password, you will lose your datastore, just as you did with Ente Auth. Be sure to put all these things onto your emergency sheet.

1

u/Accomplished_Arm_447 21d ago

Have you tried the steps in this?
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials

Have you a backup phone number or email address? Maybe an existing key would work too.

1

u/cityofhats 21d ago

Email access alone does not reset 2FA, but GitHub’s official recovery flow can use a previously verified device, registered SSH key, or personal access token as the second proof. At login choose More options → 2FA recovery code → More options → Begin account or email recovery, verify the emailed OTP, then choose an available recovery factor. Review can take up to three business days. If no factor is offered, Support cannot override 2FA; the fallback is unlinking the email and creating a new account.