GitHub no longer accepts passwords for Git authentication, secure your accounts with YubiKey

YubiKey on a desk next to a lapt

GitHub has been a longstanding supporter of strong security for its customers and developer communities. From its most recent support for using U2F and FIDO2 security keys for SSH, to its 2019 announcement of Web Authentication (WebAuthn) support for security keys and 2015 Universal Second Factor (U2F) support, the company has continued to give its millions of customers the ability to protect their accounts and projects through the use of hardware-based YubiKey authentication.

But last week marked perhaps one of the largest steps the company has taken to date  GitHub announced that as of August 13, 2021, it no longer accepts Git password authentication account passwords when authenticating Git CLI operations and will require the use of stronger authentication credentials for all authenticated Git operations on GitHub.com. This includes  SSH keys (for developers), OAuth or GitHub App installation token (for integrators), or a hardware-based security key, such as a YubiKey. 

This announcement also comes with the continued partnership between Yubico and GitHub — as well as some really sweet limited edition GitHub branded YubiKeys (act fast!). GitHub users can secure their Git Commits using a GPG key stored on their YubiKey. This is a crucial way to ensure that open source contributions are being made by the right users in developer communities or organizations.

There is strong momentum with FIDO2, WebAuthn, and passwordless – more than half (61%) of the organizations surveyed in a recent 451 Research and Yubico report have either deployed or have passwordless authentication in pilot (34% of respondents have already deployed passwordless technology, 27% in pilot). GitHub is helping to realize this future for these organizations with their move to support FIDO2 and the path toward a passwordless future to address traditional MFA pain points.

But not all forms of MFA are created equal when it comes to supporting organizations in the transition to passwordless. YubiKeys are designed to meet and evolve with your security infrastructure and can be deployed in passwordless environments with our IAM partners as a smart card or a FIDO2 security key, for example.

If you’re seeking further information on setting up your YubiKey with GitHub for commit verification and for SSH based Authentication please watch our step by step video guide or reach out to us! 

Read Yubico’s Bridge to Passwordless series to learn more about how to plan and execute a passwordless strategy.

Talk to our teamTalk to our team

Share this article:


  • Piloting Europe’s future ID: Passkeys securing digital walletsOver the last several years, passkeys have become ubiquitous. They are available on every mobile platform, in every leading browser, as part of all major enterprise IAM solutions, and in most major cloud services. Until wwWallet came along, the only place where passkeys hadn’t yet made an impact is in the rapidly developing world of […]Read moredigital identity walletspasskeysSIROSwwWallet
  • We’re excited for what’s to come – meet us in-person to find out whyIt’s been a busy year for our team, filled with exciting company and product updates aimed at better serving our customers and helping them achieve cyber resilience as AI-driven phishing threats continue evolving globally. Between industry award recognitions and key new executive leadership hires to lead Yubico to its next stage of growth and a […]Read more
  • FIPS certified vs. FIPS compliant: What’s the real difference?“Is your MFA solution FIPS compliant, or is it certified?”  This is a question we hear a lot, and for good reason. In industries where security and compliance are critical (especially in government contracts), understanding the difference between FIPS certified and FIPS compliant isn’t just semantics – it can mean the difference between meeting requirements […]Read moreFIPSNIST
  • 2025 Global State of Authentication survey: A world of difference in cybersecurity habitsIn a world that’s more connected than ever, the landscape of cybersecurity threats is constantly evolving. Bad actors, now supercharged with artificial intelligence (AI), are becoming increasingly adept at exploiting human error through sophisticated phishing and social engineering attacks. This makes robust cybersecurity a universal issue, impacting everyone from individuals to the largest global enterprises. […]Read moreGlobal State of Authenticationsurvey