GitHub no longer accepts passwords for Git authentication, secure your accounts with YubiKey

YubiKey on a desk next to a lapt

GitHub has been a longstanding supporter of strong security for its customers and developer communities. From its most recent support for using U2F and FIDO2 security keys for SSH, to its 2019 announcement of Web Authentication (WebAuthn) support for security keys and 2015 Universal Second Factor (U2F) support, the company has continued to give its millions of customers the ability to protect their accounts and projects through the use of hardware-based YubiKey authentication.

But last week marked perhaps one of the largest steps the company has taken to date  GitHub announced that as of August 13, 2021, it no longer accepts Git password authentication account passwords when authenticating Git CLI operations and will require the use of stronger authentication credentials for all authenticated Git operations on GitHub.com. This includes  SSH keys (for developers), OAuth or GitHub App installation token (for integrators), or a hardware-based security key, such as a YubiKey. 

This announcement also comes with the continued partnership between Yubico and GitHub — as well as some really sweet limited edition GitHub branded YubiKeys (act fast!). GitHub users can secure their Git Commits using a GPG key stored on their YubiKey. This is a crucial way to ensure that open source contributions are being made by the right users in developer communities or organizations.

There is strong momentum with FIDO2, WebAuthn, and passwordless – more than half (61%) of the organizations surveyed in a recent 451 Research and Yubico report have either deployed or have passwordless authentication in pilot (34% of respondents have already deployed passwordless technology, 27% in pilot). GitHub is helping to realize this future for these organizations with their move to support FIDO2 and the path toward a passwordless future to address traditional MFA pain points.

But not all forms of MFA are created equal when it comes to supporting organizations in the transition to passwordless. YubiKeys are designed to meet and evolve with your security infrastructure and can be deployed in passwordless environments with our IAM partners as a smart card or a FIDO2 security key, for example.

If you’re seeking further information on setting up your YubiKey with GitHub for commit verification and for SSH based Authentication please watch our step by step video guide or reach out to us! 

Read Yubico’s Bridge to Passwordless series to learn more about how to plan and execute a passwordless strategy.

Talk to our teamTalk to our team

Share this article:


  • CEO Corner: Maintaining stable growth while navigating global uncertaintyAs we officially close out the first quarter of 2025,  I am pleased we saw a quarter with solid growth and profitability along with ongoing demand for phishing-resistant authentication. We continue to see new types of high-profile cyber attacks appearing regularly, and a major reason for the success of phishing attacks is stolen credentials. As […]Read moreCEOCEO CornerEarningsMattias Danielsson
  • Introducing the Yubico Academy: Enabling partners for a phishing-resistant futureAt Yubico, strong partnerships are fundamental to a more secure digital world. Our commitment goes beyond providing leading security keys; it’s about actively fostering the growth of our valued partners through impactful enablement programs. A cornerstone is the Yubico Academy, featuring our comprehensive certification program.  This program enables our partners’ teams to become Yubico experts, […]Read more
  • AI is booming — but proving you’re human matters more than everIf you walked the show floor at the RSA Conference this year, you probably noticed the same thing I did: Artificial Intelligence (AI) is everywhere. Agentic AI. AI in threat detection. AI in firewalls. AI in identity management. AI-generated demos. AI everything. The energy around AI was undeniable, and we’re seeing real innovation, efficiency gains […]Read moreAIArtificial IntelligencephishingRSAC
  • Ditching passwords for good: Celebrating the inaugural World Passkey DayHave you ever been stuck in a relationship with someone who constantly lets you down, exposes your secrets, and leaves you vulnerable? Odds are you cut your losses, packed up your things and moved on. Today is the day to do the same with your passwords: say goodbye forever! The reality is a majority of […]Read morepasskeyspasswordlessWorld Passkey Day