The Error
fatal: Authentication failed for 'https://github.com/username/repo.git/'
This one blindsides you. You've been pushing to the same repo for months, everything working fine — then one morning every git push and git pull dies with this. No code change. No config change. Nothing obvious.
On Windows, the culprit is almost always Windows Credential Manager holding a stale GitHub token or a password that GitHub stopped accepting. Clear that cached entry and you're back in business within two minutes.
Why This Happens
Windows Credential Manager saves your GitHub credentials the first time you authenticate — so you don't have to type them every push. That's convenient until the stored credentials go stale. Common triggers:
- You rotated or revoked a Personal Access Token (PAT) on GitHub
- Your GitHub account password changed
- You migrated from password auth to PAT — GitHub killed password-based HTTPS in August 2021
- You switched between multiple GitHub accounts on the same machine
Once any of those happen, Git keeps silently sending the old credentials. GitHub rejects them every time. Hence fatal: Authentication failed.
Step-by-Step Fix
Option 1: Remove via Windows Credential Manager UI (Easiest)
- Open Start → search Credential Manager → open it.
- Click the Windows Credentials tab.
- Find entries starting with
git:https://github.comor justGitHub. - Click the entry → click Remove → confirm.
- Run
git pushagain — Windows will prompt for fresh credentials.
Option 2: Remove via Command Line (Faster)
Open PowerShell or Command Prompt and run:
cmdkey /delete:LegacyGeneric:target=git:https://github.com
Not sure of the exact target name? List everything GitHub-related first:
cmdkey /list | findstr /i github
Copy the target name from the output, then delete it:
cmdkey /delete:LegacyGeneric:target=git:https://github.com
Option 3: Use Git's Credential Helper Directly
Git Credential Manager has its own erase command. Run this in a terminal:
git credential-manager erase
Then type the following — exactly as shown — and press Enter twice to send EOF:
protocol=https
host=github.com
On older Git versions (pre-2.29) where GCM isn't available, use the lower-level command instead:
git credential reject
protocol=https
host=github.com
username=your-github-username
Re-authenticating with a PAT
After clearing old credentials, the next git push will ask for a username and password. Stop there — do not enter your GitHub account password. GitHub stopped accepting passwords for HTTPS in August 2021. You need a Personal Access Token instead:
- Go to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic).
- Click Generate new token (classic).
- Give it a name, set an expiry (90 days is a reasonable default), and check the
reposcope. Addworkflowif you push GitHub Actions configs. - Copy the token immediately — GitHub shows it exactly once.
- When Git prompts for a password, paste the token there (not in the username field).
Windows Credential Manager saves the new token automatically. Next push goes through without prompting.
Option 4: Switch to SSH (Permanent Fix)
Tired of token expiry? SSH doesn't have this problem. One command switches your remote:
git remote set-url origin git@github.com:username/repo.git
You'll need an SSH key added to your GitHub account first. After that, authentication is silent and token-free indefinitely.
Verify the Fix
Push something small to confirm:
git push origin main
Or test without pushing anything:
git ls-remote origin
If it lists refs — HEAD, branches, tags — without an error, you're sorted. Want to confirm what's now stored in Credential Manager?
cmdkey /list | findstr /i github
You should see a fresh entry. The old stale one will be gone.
Tips
PAT expiry is the main recurring cause. When you create a token, GitHub lets you set 7, 30, 60, or 90 days — or no expiry. Tokens with no expiry are convenient but a security risk. I set 90 days and add a calendar reminder 10 days before the expiry date. Otherwise you'll hit this error mid-push, mid-demo, at the worst possible moment.
Guard your PAT like a password. A token with repo scope has full read/write access to all your private repos. Don't paste it in Slack, don't hardcode it in a script, don't commit it anywhere. If you need to generate strong random tokens for other purposes — API keys, test secrets — I use ToolCraft's password generator, which runs entirely in the browser with nothing uploaded server-side.
Multiple GitHub accounts on one machine is a separate headache. Credential Manager only holds one entry per host, so accounts step on each other. SSH with different host aliases in ~/.ssh/config handles this cleanly — each project points to a different alias, each alias maps to a different key, and there's no credential collision.
If the problem keeps coming back after you clear credentials, check your credential helper config:
git config --global credential.helper
Modern Git for Windows installs should output manager. If you see wincred, store, or nothing at all, that's likely causing inconsistent caching behavior — and worth fixing before the next expiry cycle hits.