GitHub launches support for passkeys in public beta, letting users who opt in upgrade from security keys to passkeys, and use those in place of password and 2FA
GitHub announced today the introduction of passwordless authentication support in public beta, allowing users to upgrade from security keys to passkeys.
Context & Ripple Effects
This is the third act in a decade-long authentication arc at GitHub: the company added U2F security key support back in 2015, extended hardware-key auth to SSH Git operations in 2021 while planning to drop passwords for Git operations, and now lets opted-in users retire both the password and the second factor in favor of a passkey.
The move also lands on ground Google prepared: [[a:983743|Google began rolling out passkey sign-in on Android and Chrome to beta testers in late 2022]], so GitHub is adopting a credential format its users' devices already support rather than betting on new hardware.
First-order effects
- Opted-in GitHub users can now sign in with a passkey alone, replacing the password-plus-2FA flow, while existing security-key holders get an explicit upgrade path off hardware tokens.
Second-order effects
- Rival code-hosting and developer platforms face pressure to match passwordless sign-in or explain why their accounts remain phishable relative to GitHub's, since developer credentials are the keys to source code and release pipelines.
Third-order effects
- If the pattern holds across platforms, account-takeover defense shifts from user-managed second factors to platform-issued cryptographic credentials, making phishing-resistant auth a baseline expectation for any service holding supply-chain access rather than a premium feature.
The trend: Developer platforms are converging on passkeys as the endpoint of a decade-long march away from passwords, following the device-level groundwork laid by Google and Apple.