Your GitHub account is the front door to your code — repositories, projects, and for many developers a professional reputation and even production access. A compromised account can mean stolen source code or malicious commits in your name, so a strong, unique password and two-factor authentication are essential. Our GetMyPassword team covers how to change your GitHub password, reset it when you are locked out, and secure your developer account.
Change your password in settings
- Sign in at github.com and open Settings from your profile menu.
- Go to Password and authentication.
- Under Change password, enter your old password, then the new one twice.
- Click Update password.
GitHub checks new passwords against known breaches, so a reused or weak password may be rejected — a generated one sails through.
Reset a forgotten password
On the sign-in page click Forgot password? and enter your email or username. GitHub emails a reset link; open it and create a new password. If you have two-factor authentication enabled, keep your authenticator or recovery codes handy to finish signing in.
Do not forget tokens and SSH keys
GitHub access is not only your password. Personal access tokens and SSH keys grant access independently, so after a suspected compromise, review and revoke any you do not recognise under Settings. If a token leaked in code, treat it like a password and rotate it immediately.
For developers, two-factor authentication on GitHub is not optional — it is now required for those who contribute code. A stolen GitHub login can poison software that thousands of people install.
Secure it with a unique password and 2FA
Give GitHub a password you use nowhere else, created with our password generator, and enable two-factor authentication — ideally an authenticator app or a security key. Save your recovery codes somewhere safe. With these in place, your code and your reputation stay protected even if a password leaks.
Frequently asked questions
How do I change my GitHub password if I forgot it?
On the sign-in page click “Forgot password?”, enter your email or username, and follow the reset link GitHub emails you. If two-factor authentication is on, you will also need your authenticator or recovery codes.
Why won’t GitHub accept my new password?
GitHub rejects passwords found in known data breaches and ones that are too weak. Use a longer, unique password — a generated one easily meets the requirements.
Is two-factor authentication required on GitHub?
GitHub now requires two-factor authentication for users who contribute code. Even if you are not required, enabling it is strongly recommended to protect your repositories and account.