Fix 'Authentication failed' when pushing to GitHub

Does this match your situation?

• 'remote: Support for password authentication was removed on August 13, 2021.'
• 'fatal: Authentication failed for https://github.com/...'
• Your password is definitely right but Git rejects it.
• It worked until you changed your password or the token expired.

Step-by-step fix

1. Check which protocol you're using

   An https:// URL authenticates with a token; a git@ URL authenticates with an SSH key. The fix is completely different for each, so establish this first.

   step 1Copy

   git remote -v
   

2. Option A — switch to SSH (recommended)

   SSH keys don't expire, don't need rotating, and never prompt again once set up. Generate a key, add the public half to GitHub, then repoint the remote.

   step 2Copy

   ssh-keygen -t ed25519 -C "you@example.com"
   # press Enter through the prompts
   
   # copy the PUBLIC key and paste it at github.com/settings/keys
   cat ~/.ssh/id_ed25519.pub
   
   ssh -T git@github.com          # verify it works
   git remote set-url origin git@github.com:USER/REPO.git
   

   Show the PowerShell (Windows) version

   PowerShell (Windows)Copy

   ssh-keygen -t ed25519 -C "you@example.com"
   Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard
   # paste at github.com/settings/keys
   ssh -T git@github.com
   git remote set-url origin git@github.com:USER/REPO.git
   

3. Option B — use a personal access token

   If you must stay on HTTPS, create a token and use it wherever Git asks for a password. Fine-grained tokens are scoped to specific repositories and are the safer choice.

   step 3Copy

   # github.com/settings/tokens -> generate a token with 'repo' scope
   # then push, and paste the TOKEN as the password:
   git push
   # Username: your-github-username
   # Password: ghp_xxxxxxxxxxxxxxxxxxxx
   

   ⚠️Copy the token immediately — GitHub shows it exactly once.

4. Clear the stale credential that's being reused

   This is the step people miss. Your credential helper cached the old password and keeps sending it without asking you, so nothing you type makes any difference until it's cleared.

   step 4Copy

   # Git Credential Manager
   git credential-manager erase
   
   # macOS keychain
   git credential-osxkeychain erase
   host=github.com
   protocol=https
   
   # Windows: Control Panel -> Credential Manager -> Windows Credentials
   #          -> remove git:https://github.com
   

Why this works

Account passwords were removed as a Git credential because a leaked password compromises everything you own, whereas a token can be scoped to one repository and revoked independently. The confusing part is the credential helper: it stores the first credential that works and replays it silently forever, so once a token expires or is revoked you get authentication failures that seem impervious to typing the right thing. Clearing the stored credential is what makes Git ask again.

If that didn’t work

• Confirm the token hasn't expired and has the repo scope at github.com/settings/tokens.
• For an organisation repo, check whether SSO authorisation is required for the token.
• Test SSH explicitly: ssh -vT git@github.com shows exactly which key is offered.
• If port 22 is blocked on your network, use SSH over HTTPS: set the host to ssh.github.com port 443 in ~/.ssh/config.

How to stop it happening again

• Use SSH keys — set up once, never expire, no rotation.
• If you use tokens, note the expiry date somewhere you'll see it.
• Configure a credential helper backed by your OS keychain rather than plaintext storage.

Commands used in this guide

Frequently asked questions