Click here if you are seeing a "Token is unsafe!" error setting up 2FA with FreeOTP.
When setting up the FreeOTP authenticator app, you may see an error indicating that the "Token is unsafe!". This is because GitHub uses an 80 bit key for TOTP secrets as a compatibility shim for Google Authenticator, which also used 80 bit keys. FreeOTP validates that the key is at least 128 bits in length, and shows an "unsafe algorithms" error as a result. Because we can't control who uses which authenticator app, we opt for supporting Google's app over potentially blocking their ability to use TOTP.
When choosing an authenticator app, please prefer apps that support cloud backup of your secrets such as Authy, 1Password, or Microsoft Authenticator. A top cause of account lockout is phone loss, where the TOTP secrets for an account are held only on the previous phone.