diff --git a/remoteappmanager/jupyterhub/auth/github_whitelist_authenticator.py b/remoteappmanager/jupyterhub/auth/github_whitelist_authenticator.py
index 39f5c7fd0..334bcd382 100644
--- a/remoteappmanager/jupyterhub/auth/github_whitelist_authenticator.py
+++ b/remoteappmanager/jupyterhub/auth/github_whitelist_authenticator.py
@@ -35,7 +35,8 @@ def whitelist(self):
 
             with open(self.whitelist_file, "r") as f:
                 whitelisted_users = set(self.normalize_username(x.strip())
-                                        for x in f.readlines())
+                                        for x in f.readlines()
+                                        if not x.strip().startswith("#"))
         except FileNotFoundError:
             # empty set means everybody is allowed
             return set()
diff --git a/remoteappmanager/jupyterhub/auth/tests/test_github_whitelist_authenticator.py b/remoteappmanager/jupyterhub/auth/tests/test_github_whitelist_authenticator.py
index 245114f1e..cb1683233 100644
--- a/remoteappmanager/jupyterhub/auth/tests/test_github_whitelist_authenticator.py
+++ b/remoteappmanager/jupyterhub/auth/tests/test_github_whitelist_authenticator.py
@@ -96,3 +96,17 @@ def test_dummy_setter(self):
         auth.whitelist_file = whitelist_path
         auth.whitelist = set()
         self.assertNotEqual(auth.whitelist, set())
+
+    @gen_test
+    def test_comment_out(self):
+        whitelist_path = os.path.join(self.tempdir, "whitelist.txt")
+        with open(whitelist_path, "w") as f:
+            f.write("# this is a comment\n")
+            f.write("foo\n")
+            f.write("bar\n")
+
+        auth = self.auth
+        auth.whitelist_file = whitelist_path
+        yield auth.get_authenticated_user(Mock(), {"username": "foo"})
+
+        self.assertEqual(len(auth.whitelist), 2)