How to disable SMS option in 2FA account access, without disabling Webauthn and 2FA entirely [obsolete]

[mk-fg]

EDIT:
THIS IS OBSOLETE (as of April 2023), and no longer how that UI looks and works on github!
There is no "Reconfigure" button anymore, likely because it's now possible to do without it.

Select Topic Area

Question

Body

I have and want to have two-factor authentication enabled, but only with strong methods that are useful to me, like Webauthn, and disable terrible insecure methods that can easily be used to bypass these entirely.

But under "Password and Authentication" - "Two-factor authentication", github lists "SMS/Text message" as one allowed 2FA method, which is definitely not the one I want to have, as it is rather trivial and cheap to attach new SIM to any phone with local carriers (or mostly their minimally-paid staff rather).
I can click "Edit" on that SMS authentication method and enter a different phone, but I see no way to disable or remove it.

Is there a way to disable "SMS/Text message" second-factor authentication method?
And if not, why not? Maybe it can be a request for improvement in Github's currently-broken 2FA instead.

Here is how configuration screen looks for me (after clicking on "..." next to SMS 2FA method):

2FA is required by an org, but that doesn't mention SMS anywhere specifically, and 2FA shouldn't be assumed to be SMS.

Having SMS method force-enabled makes 2FA rather pointless for me - anyone, with at least some minor local knowledge and ~$50, can just ignore whatever I setup there, SMS-bypassing it all, and then do whatever they want on my github and wherever I have commit access to.

This is not about "Fallback SMS number" recovery, which I never setup and indeed can be disabled, but rather disabling (and ideally never even allowing) SMS as a 2FA method to log into my github account.

Thanks in advance for any assistance.

[mk-fg]

Was told a solution after asking this question elsewhere - apparently "Reconfigure" button in the top-right can replace mandatory SMS auth option with TOTP, which is still not what I'd use, but easier to forget and ignore, unlike leaving SMS one open.
It does not currently clear Webauthn, and can be used even if account is required to have 2FA by an org. Worked for me.

[mk-fg]

Just checked my settings and yeah, it's gone - looks like they did change how things work there.

[SparshSharmaOfficial]

@mk-fg
What's the latest solution as I have same problem as the OP?

[mk-fg]

UI is different now, so I've no idea, unfortunately.

[samip5]

@mk-fg What's the latest solution as I have same problem as the OP?

You need to add Authenicator App, before it will let you do pretty much anything despite if one has other forms of 2FA enabled.

[SparshSharmaOfficial]

@samip5
Thanks but I already got it from someone: To disable SMS configuration, first set/configure using any Authenticator App and only then the option appears to remove SMS one. But I was trying to do the opposite. Unfortunately Github is poor at maths: law of commutative! 😂

[DNin01]

They also said they were working on making it possible to use security keys as the primary second factor.

In the future, you'll also find security keys there as an option for initial setup on supported devices and browsers.

[kalbfled]

I have the same question/issue, and I also don't see a "Reconfigure" button.

[mk-fg]

Just checked - there isn't one for me either, guess it should be done in some different way.
Did edit the question/title to mark it as obsolete, as it's likely a global change on the site.

[kalbfled]

I added an authenticator app in addition to my security keys. Once I did that, I had the option to disable SMS.

[DNin01]

That makes sense - security keys cannot be used as a "primary" authentication method yet, though GitHub said they are working on that feature.

[beeb]

I added security keys as 2FA and selected them as preferred method, but I still can't remove the SMS method. Only an "edit" button that allows to change the number, no way to disable it.

EDIT: after adding the Authenticator app again, I was able to disable the SMS option. But then I can't disable the Authenticator app option. Why can security keys not be the only selected option?

[pedrosimao]

Maybe they are afraid of people loosing their security keys? But anyway, that's why recovery codes exists right?

[VannTen]

I'm facing the same problem.
Passkeys are nice and all, but if I can't disable SMS 2FA, it's kinda pointless.

[pedrosimao]

Same here! Did you find a way?

[scheepers]

I swear if I have to solve that puzzle one more fkn time I'll go sterile.

I've added SSH keys, passkeys, my blood type and sacrificed the artworks of several small children.

Where is the SMS 2fa removal or 2fa reconfigure process, button or altar of mammon so I can access an organisation I belong to?

[PavlekJ]

it wasnt showing for me either when it was my only 2fa method, I thought I was going insane.
Try configuring another 2fa method (ex. authenticator app), then you should see the three dots button in the SMS/Text message cell.

[lunvang]

Just found the solution!!
You have to add the "Authenticator app" two-factor method, and only then you'll be able to remove SMS.
I wish the UI would communicate that better, it was a pain to figure out.

[ianrtracey]

Wow this took me forever. Thank you!

[milandamen]

I want to use just WebAuthn and recover codes, and not have to set up TOTP as well.

Having to set up SMS or TOTP regardless of any other authentication method sucks. WebAuthn is more secure than other methods, and there's no reason to decrease security by requiring SMS/TOTP as well.

[samip5]

Agreed. That's absolutely annoying. Me with multiple 2FA options, including Github Mobile, Security Keys and Passkeys, only Authenication App allowed me to remove SMS which makes absolutely no sense.

[Paol0B]

Hi, try this

1. Go to GitHub Security Settings 
      👉 https://github.com/settings/security

2. Scroll to "Two-Factor Authentication" 
      You’ll see a list of your active 2FA methods (e.g., SMS, WebAuthn, TOTP).

3. Find the SMS Method 
      Click the three dots (⋯) next to the SMS method.

4. Click “Remove” or “Edit” 
      - If “Remove” is available, click it to delete SMS as a 2FA method.
      - If only “Edit” is available, you may need to reconfigure your 2FA.

5. Use the “Reconfigure” Option (if needed) 
      - Click “Reconfigure” at the top of the 2FA section.
      - Replace SMS with another method like TOTP (authenticator app) or WebAuthn.
      - This does not disable 2FA or remove WebAuthn.

6. Confirm and Save 
      Make sure you still have at least one active 2FA method (e.g., WebAuthn or TOTP).

---

Notes

• If your organization requires 2FA, GitHub will not let you remove all 2FA methods.
• You must keep at least one method active to avoid being locked out.

---

[samip5]

" Click the three dots (⋯) next to the SMS method." THat is NOT POSSIBLE even with multiple other factors (eg WebAuthn or/and Security Keys) unless Authenicator App is also used.

[caohy1988]

I cannot find three dots (⋯) next to the SMS method. in my github account and cannot remove it , can you help me resolve it? thanks

[loboda-newfire]

What worked for me:

• go to https://github.com/settings/security
• scroll down to "Two-Factor Authentication"
• click on 3 dots at the end of "Two-Factor Authentication" title
• click "Disable two-factor auth"
• reconfigure Two-factor authentication from the scratch

[caohy1988]

I cannot find three dots (⋯) next to the SMS method. in my github account and cannot remove it , can someone help me resolve it? thanks

[iennae]

Heya @caohy1988 , I ran into this today. What you need to do is add an Authenticator app and then the three dots option will appear. As soon as you remove the SMS/Text message option you'll then lose the three dots option. It appears that there is some kind of bug in this interface that requires one to have both Authenticator and SMS/Text message for the remove option to appear. Hope this helps!

[SnathanP]

Hey guys, this is kinda fucked up. I wanted to enforce 2FA and "secure 2FA" on my organization (eg, no SMS) and its causing trouble for newcomers: if they have 2FA enabled with SMS, basically, we can do nothing. Not cool :/

[iennae]

heya @SnathanP the path to fixing this is have them add an Authenticator app and then the three dots option will appear. Then they can remove the SMS option which will then mean they lose the three dots option. I ran into this today and I hope this helps.

[wherka-ama]

Guys, I've just helped one lost soul to sort this issue out. I'm not sure if you've tried that before, but a simple way to deal with it is to ensure you have a Authenticator and/or Mobile flow active and then start the sign in in Incognito mode.

That guarantees you don't have any session details, cookies etc. It seems to be pretty effective in exposing the Edit/Delete on the SMS/Text message.

[shinybrightstar]

Hi @mk-fg 👋,

Currently, GitHub requires you to first set up either an authenticator app (TOTP) or SMS as your primary 2FA method. Once you have done that, you can add GitHub Mobile or Security Keys as an additional 2FA option, which allows you to verify sign-ins directly from your device.

After enabling 2FA, GitHub provides a set of recovery codes. Download these codes and keep them in a secure, offline location. These are extremely important—if you lose access to all your 2FA methods and your recovery codes, it may be difficult to restore access to your account.

You can find more information in the official GitHub documentation.

Thank you!

[james-ecd]

I had to set up an Authentication app as a 2fa option before it gave me the option to disable sms. Once I had setup an authentication app, three dots appeared on the the sms option giving an option to disable

[wherka-ama]

@james-ecd : indeed. You do need to have these two methods in place in order to kick the 3rd one out. This is what we've noted as well.

Summarising:

• in order to remove the SMS/Text or in fact any other auth method, you need to have two other methods configured on top of it(GitHub Mobile + Authenticator app)
• in some cases we have some issues with weird state of a three dots button - it is shown, but not usable; in such case you may try using incognito mode of your browser

[MahdiBM]

This implementation by GitHub is absolutely bonkers.
It's clear they're not taking security seriously and just trying to look like they do.

How do any of these make any sense?

• I have set up (multiple) security keys, but no no no you have to set up "Authenticator app" to be able to remove SMS auth?! Worse yet, this is not pointed out anywhere?
• Now that I've deleted SMS auth, there is no option to delete "Authenticator app" when I already have security keys set up?!
• Now that I've set up both auth-app and security keys (both use the security keys anyway), I can't remove my GitHub mobile app as an auth method?!

All the way through the multi-auth set up, GitHub is like "No you don't need to remove your weakest link! Please don't!" while trying to obstruct the way to remove those weaker links.

I even contacted GitHub support a year+ ago. Got no response back of course. Until I read this thread about how to remove SMS auth.

[milandamen]

Yep they don't care and don't understand security and UX.

[ChaseKnowlden]

Just add your security key and your authenticator app to your GitHub account.

[MahdiBM]

I don't see the relation of this comment to my comment to be honest. I thought I was clear I already have both those set up. I thought I was also clear that I want to delete the weaker links now as I have no need for them ("GitHub mobile" and "authenticator app"). So really struggling to see how this comment is supposed to be helpful. Perhaps it wasn't directed towards my comment?

[yhxd123]

in 2026, you have to first download a auth app (e.g. Google/Microsfot Auth) from app store then register that app as auth method, then you are allowed to delete text message option. It kinda sucks but make sense since Github enforces auth app for a long time (since 2016)