GitHub Lost 2FA Recovery Codes: Account Recovery Request

You changed phones, lost the authenticator app, or your device died, and GitHub now asks for a code you cannot produce. Your recovery codes are not where you thought they were. For a freelancer or a small agency, that login may hold client repositories and a business organisation, so the stress is real.

This guide follows GitHub's own documentation. It sets out each recovery factor the docs describe, the account recovery request, and the point where the docs say recovery is no longer possible. We say that plainly now: GitHub's docs state that Support will not restore access to a 2FA account if you have lost your credentials and your recovery methods, and AwareXone cannot promise to do what GitHub says it will not. Official steps come first. One wrong step can cost you the account, so know what you are doing before you start.

Last checked: 28 October 2026.

#Quick Answer: What Are Your Options?

GitHub's page Recovering your account if you lose your 2FA credentials lists these ways back in: a 2FA recovery code, a passkey, a security key, a fallback number if one was already configured, or an account recovery request that uses a verified device, an SSH key or a personal access token. The page also carries this warning: "GitHub Support will not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods."

#Which Recovery Factor Do You Have?

Work down the table until you find something you still hold. The right column is what the docs say, not what we have tested.

We do not ask for your recovery codes, your authentication codes or your password. The configuration page tells you not to share or distribute your recovery codes, and that applies to us too.

#Using a Recovery Code

The page says to go to the GitHub login page, type your username and password, click Sign in, then choose 2FA recovery code under More options, type one of your codes and click Verify. If you do not know your password, the page says you can use a recovery code after requesting a new password. If you see a "Recovery code authentication failed" error, the page says the code is invalid and points to its troubleshooting guide.

GitHub's Troubleshooting two-factor authentication issues page has checks worth doing first if your problem is a code that fails and not a lost method. For an authenticator app it says to use the app you originally set up, to make sure your phone clock is set automatically, to enter a fresh code promptly and to read the correct account entry. For text messages it covers coverage, plan limits and filters. It also carries a warning that GitHub Support cannot assist with troubleshooting your 2FA methods, including text message delivery.

#The Account Recovery Request

If you know your password but have no 2FA credentials and no recovery codes, the page describes a request. You choose Begin account or email recovery, confirm you understand, and ask GitHub to send a one-time password to the email addresses on the account. You then choose a recovery verification factor: Verify with this device, SSH key, or Personal access token. The page says a member of GitHub Support will review your request and email you within three business days. If it is approved, you get a link to finish recovery. If it is denied, the email includes a way to contact support.

The page adds three cautions. First, an authentication factor may not be available even if you used it before, and it gives the example that SSH keys are removed from accounts after a period of inactivity. Second, the page says that GitHub will not review additional requests submitted during the review period, so a second request does not speed things up. Third, the page also mentions a 3-5 day waiting period, which is not the same figure as the three business days. Its wording on timing is not consistent, so read the live page and allow for the longer figure.

If you do not know your password, the page says to request a new password first. It says the reset link must be used within 3 hours of arriving, and that only primary and backup email addresses can request one. You will then be prompted for your 2FA credentials, and you can begin the recovery request from there.

#If You Have No Recovery Method

The same page says that if you cannot use any recovery method, you have permanently lost access to your account. It describes one thing you can still do: unlink the email address tied to the locked account, so the address can be linked to a new or existing account. GitHub's Unlinking your email address from a locked account page warns that following these steps will not disable 2FA or provide access to a locked account, and that if you cannot regain access, the steps permanently break the link between the account and the email address. It says to be sure you have lost all access first.

The unlinking page says you can start with your password and the Begin account or email recovery option, then use the Start unlinking email button. GitHub sends a verification link to each email on the account, with the subject "[GitHub] Unlink this email". It also says that if the locked account has any form of payment set up, you should contact GitHub Support to cancel future payments. We do not state any amounts here.

The pages do not say what happens to organisations, repositories or client access tied to a locked account. If client work depends on it, talk to the client and any organisation owner who can add you back to what you need, because the docs do not describe a route for that.

#Set This Up Today: Prevention Table

GitHub's Configuring two-factor authentication recovery methods page says it strongly recommends configuring two or more authentication methods, as well as storing your recovery codes securely. Use it as a checklist while you still have access.

The page also says that generating a new set of recovery codes invalidates any codes you generated before, so replace your stored copy when you do it. For related guidance on other services, see our guides on Google 2-Step Verification when you lose your phone and Microsoft Authenticator when you lose your phone.

#What the Pages Do Not Say

• They do not say what GitHub Support looks for when it reviews a request, beyond the verification factor you choose.
• They give no way to recover an account with no recovery method.
• They do not say how long an SSH key must be inactive before it is removed.
• They do not say what happens to an organisation you own when your account is locked.

#When It Is Safer to Get Expert Help

Some people sort this out alone, and the official steps come first. The risks are plain. A second request does not speed up a review, and the docs say GitHub does not review additional requests during that time. Unlinking your email address permanently breaks the link to the locked account, so do it only when you are sure. A scam message that offers to restore a GitHub account, or asks for a recovery code, is not using any route the docs describe.

If the account holds client work or your income depends on it, or you are not sure which factor you still have, an experienced team such as AwareXone can help you read your options and plan the order of steps. We cannot restore access that GitHub says it will not restore, and we do not promise a result. See our account security page, and use the Apply for Case Review button at the end of this guide.

#When a Case Review Makes Sense

A review helps if you are unsure whether a device, key or token still counts as a recovery factor, or if you want to secure your other accounts and plan a safer setup after this scare. SocialSafe by AwareXone is a Malaysia-based service, independent of GitHub, that helps you use the official routes. We never ask for your password or any code. See how we work on our trust page.

#Frequently Asked Questions