GitHub no longer accepts passwords for Git authentication, secure your accounts with YubiKey

August 16, 2021 3 minute read

GitHub has been a longstanding supporter of strong security for its customers and developer communities. From its most recent support for using U2F and FIDO2 security keys for SSH, to its 2019 announcement of Web Authentication (WebAuthn) support for security keys and 2015 Universal Second Factor (U2F) support, the company has continued to give its millions of customers the ability to protect their accounts and projects through the use of hardware-based YubiKey authentication.

But last week marked perhaps one of the largest steps the company has taken to date  GitHub announced that as of August 13, 2021, it no longer accepts Git password authentication account passwords when authenticating Git CLI operations and will require the use of stronger authentication credentials for all authenticated Git operations on This includes  SSH keys (for developers), OAuth or GitHub App installation token (for integrators), or a hardware-based security key, such as a YubiKey. 

This announcement also comes with the continued partnership between Yubico and GitHub — as well as some really sweet limited edition GitHub branded YubiKeys (act fast!). GitHub users can secure their Git Commits using a GPG key stored on their YubiKey. This is a crucial way to ensure that open source contributions are being made by the right users in developer communities or organizations.

There is strong momentum with FIDO2, WebAuthn, and passwordless – more than half (61%) of the organizations surveyed in a recent 451 Research and Yubico report have either deployed or have passwordless authentication in pilot (34% of respondents have already deployed passwordless technology, 27% in pilot). GitHub is helping to realize this future for these organizations with their move to support FIDO2 and the path toward a passwordless future to address traditional MFA pain points.

But not all forms of MFA are created equal when it comes to supporting organizations in the transition to passwordless. YubiKeys are designed to meet and evolve with your security infrastructure and can be deployed in passwordless environments with our IAM partners as a smart card or a FIDO2 security key, for example.

If you’re seeking further information on setting up your YubiKey with GitHub for commit verification and for SSH based Authentication please see our joint whitepaper, watch our step by step video guide, or reach out to us! 

Read Yubico’s Bridge to Passwordless series to learn more about how to plan and execute a passwordless strategy.

Share this article:

Recommended content


Everything you need to know about the revised eIDAS regulation

In June 2021, the EU Commission announced its plans for a revised eIDAS regulation. eIDAS (electronic IDentification, Authentication and trust Services) is the EU regulation 910/2014 on electronic identification and trust services in the EU. It came into force in 2014, so the revision is a major update to eIDAS. The past two years the ...


Top five pitfalls companies should avoid when rolling out a passwordless strategy

Given the number of breaches in the news today where passwords were at the root of the problem, many companies are now exploring the benefits of a secure passwordless future. Secure passwordless logins not only bring cost efficiencies and a more frictionless user login experience into the organization, but deliver the security that is necessary ...


Your Bridge to Passwordless: Seven Steps to Execute a Smooth Passwordless Implementation

Learn about the key considerations to take into account when determining your path to passwordless


State of Alert: Multi-factor authentication and the future of data

Read this report to learn why multi-factor authentication is critical for state and local government agencies, the consequences of not strengthening authentication, and how to bridge to a passwordless future