Keep Git credentials on disk with a clear security boundary

You will configure Git to remember an HTTPS username and password or access token in its file-based credential helper, check where that file lives, and remove the helper again. The trade-off is blunt: git-credential-store keeps the secret unencrypted, protected only by filesystem permissions. If that is not acceptable, use an operating-system keychain helper or the short-lived git-credential-cache instead.

Allow about ten minutes. You need Git and an HTTPS remote. The examples use Git 2.43.0 from the installed git-man package on this machine. No command here needs sudo. Do not use this helper on a shared account or on a machine where other users can read your home directory.

1. Check the version and existing helper

Read the current configuration before changing it. This is an ordinary, read-only check:

$ git --version
git version 2.43.0
$ git config --global --get-all credential.helper

The second command may print nothing. If it prints an existing helper, decide whether adding a persistent plaintext store is really intended. Several helpers can be configured, and Git tries them in turn, so adding store can weaken an otherwise safer setup.

Checkpoint: write down any existing helper value before proceeding. You will need it if you later restore the configuration manually.

2. Understand what will be stored

The helper is intended to be called by Git, not normally by you. Git sends it operations such as 'get', 'store' and 'erase' through standard input. A stored entry is a URL-shaped line containing the protocol, username, password and host, for example:

https://USER:[email protected]

That is plaintext. A personal access token used as the password is still a credential, and anyone who can read the file can use it until the hosting service revokes or expires it. Never paste a real token into a guide, shell history, issue tracker or terminal recording.

By default, lookups check ~/.git-credentials first, then $XDG_CONFIG_HOME/git/credentials. If XDG_CONFIG_HOME is empty or unset, the second location is ~/.config/git/credentials. A write uses the first existing file, or creates ~/.git-credentials when neither exists.

3. Enable the helper deliberately

To enable the default file location for your user, run:

$ git config --global --add credential.helper store

This changes your user Git configuration. It does not ask for a credential or create the credentials file immediately. The next HTTPS operation that needs authentication will ask for a username and password or token, then the helper will save what Git approves.

If you only want the setting in one repository, omit --global while running the command from that repository:

$ git config --add credential.helper store

Repository-local configuration is easier to scope, but it still points at a user-readable plaintext store by default. It is not a substitute for secure storage.

Verify the setting without printing a secret:

$ git config --global --get-all credential.helper
store

4. Perform one real HTTPS operation

Use the operation you already need, such as a push to an HTTPS remote:

$ git push https://example.invalid/OWNER/REPOSITORY.git BRANCH
Username: YOUR_USERNAME
Password: YOUR_ACCESS_TOKEN

Replace each uppercase value with your real remote details. The example host is intentionally invalid, so do not run it as a connectivity test. On a real remote, Git passes the entered credential to the configured helper after successful authentication. Later operations matching the same protocol, host and username can use the saved entry without prompting.

Do not put the token directly in the remote URL or a command line. Command lines can appear in shell history and process listings. If the remote uses a token as its password, type or paste it only at the password prompt supplied by Git or by your hosting service's approved authentication flow.

5. Check the file without exposing its contents

Confirm which default file exists and inspect its mode. These commands reveal names and permissions, not the credential text:

$ if test -f "$HOME/.git-credentials"; then
>     stat -c '%a %n' "$HOME/.git-credentials"
> elif test -f "${XDG_CONFIG_HOME:-$HOME/.config}/git/credentials"; then
>     stat -c '%a %n' "${XDG_CONFIG_HOME:-$HOME/.config}/git/credentials"
> else
>     printf '%s\n' 'No credential file has been created yet'
> fi
600 /home/YOUR_USER/.git-credentials

The installed helper sets a created or used file to mode 600, meaning only its owner can read and write it. Treat that as a minimum safeguard, not encryption. If the path is a symlink or the directory is shared, stop and investigate before storing anything.

Do not open the credentials file in an editor. The documented format permits one credential URL per line and does not provide a comment format. Editing can leave a malformed entry or place the secret in an editor backup file.

6. Handle matching and path surprises

Matching normally considers the protocol, hostname and username when one is already known. A credential stored for one HTTPS host is not automatically a credential for another host. By default, Git does not distinguish repository paths on the same HTTP(S) host, so a stored entry for one repository can be reused for another repository on that host. If that boundary matters, review the credential.useHttpPath setting before storing a token.

When both default files exist, the home-directory file has precedence for a matching lookup. An erase operation removes matching credentials from all default files. This is why moving an entry by hand is a poor recovery method: use Git's credential operation or revoke the token at the hosting service if you suspect disclosure.

7. Remove the helper and recover

Before removing the helper, check whether the global value is exactly the one you added:

$ git config --global --get-all credential.helper
store

Remove only matching store entries:

$ git config --global --unset credential.helper store

This stops Git selecting the global store helper; it does not delete credentials already on disk. To remove the stored credential, use the helper's erase operation with the relevant protocol and host:

$ printf '%s\n' \
    'protocol=https' \
    'host=HOSTNAME' \
    '' | git credential-store erase

Replace HOSTNAME with the real host. The command may erase matching entries in both default files. If a token may have been exposed, revoke it with the hosting provider as well; deleting a local line cannot undo a copied secret.

If you had another helper before this change, restore that exact value with the command recorded in step 1, for example git config --global --add credential.helper YOUR_PREVIOUS_HELPER. Check the result with git config --global --get-all credential.helper.