Behind GitHub's new authentication token formats
Apr 5, 2021Indigo K

Summary
Introduced new authentication token formats with identifiable 3-letter prefixes (e.g., 'ghp' for personal access tokens), an underscore separator for improved readability and double-click selection, and a 32-bit CRC32 checksum encoded in Base62 for offline verification. These changes increase token identifiability, reduce secret scanning false positives to an anticipated 0.5%, and increase token entropy (e.g., from 160 to 178 bits for OAuth tokens).