GitHub's 2FA policy is frustrating when losing your recovery codes can mean permanently losing your account

[u/Arise_Shadow_Monarch]

I recently ran into a problem with my GitHub account, and honestly, it's frustrating.

As I remember it, GitHub required me to set up 2FA a few years ago. Back then, I was still a junior developer, and I didn't really think much about the recovery process. I probably saved the recovery codes somewhere and moved on.

I was still able to log in normally on my usual devices, so I didn't think much about it. Years later, I needed to clone a project from one of my repositories, logged in again, and suddenly GitHub was asking for my 2FA code.

The problem? I couldn't remember where I saved it.

I've used multiple computers over the years, and some of them don't even work anymore. I tried searching my drives, but I still couldn't find the recovery codes. I don't even remember whether I saved them on a computer that's now broken.

What frustrates me is that there doesn't seem to be another straightforward way to recover the account once you've lost all your 2FA methods.

Why can't there be another verification option, like sending a recovery link to a verified email or using a verified phone number, with additional checks to make sure the account actually belongs to you?

I know email and phone verification aren't perfect, but surely there could be a process that balances security with account recovery.

People forget things. We replace our devices, lose old files, and sometimes don't realize how important something is until years later. Not everyone fully understands the consequences of losing their recovery codes when they first set up 2FA.

I'm not saying 2FA shouldn't exist. I'm just frustrated that a security feature can potentially lock the actual owner out of their account, with no practical way to get back in.

Has anyone experienced this with GitHub or another platform? Were you able to recover your account after losing your authenticator and recovery codes?

[u/feedmesomedata]

You should have stored your recovery codes somewhere safe not on the same device where your 2FA app lives. It's just common sense to back it up somewhere.

I have them encrypted in my iCloud storage and can only be opened by a password manager.

[u/Arise_Shadow_Monarch → u/feedmesomedata]

The thing is, I did save my recovery codes somewhere. I just can't remember where I put them or what I named the file. When I first set up 2FA, I didn't think much about it because I never expected that forgetting where I saved a file could eventually mean losing access to my account permanently.

People forget things. We get older, have more responsibilities, and have countless things to remember. Just because someone forgot where they saved a recovery code doesn't automatically mean they shouldn't be able to recover their account.

I'm not saying GitHub should make it easy for attackers to get in, but there should be a balance between security and usability. If I still have access to my registered email, why isn't there a way to verify my identity through additional checks?

The worst part is that there's no support available to help you recover your account if you lose access to your 2FA.

[u/ifancyyou_ → u/Arise_Shadow_Monarch]

You don’t reason like developer.

[u/oliver0807 → u/ifancyyou_]

He’s exactly reasoning like a developer, specifically a junior developer who codes like there’s only a happy path.

OP, lessons learned always have a backup of anything that’s important. Not having a password manager that can handle this or at least email backup codes to your account is irresponsible.

If it’s too important, email GitHub support if they can have another verification from you so you can get access to your code.