--- title: Managing your secrets in Git 🗝 | daily.dev description: We have always been told not to store secrets in Git. But what if I told you that we manage all our secrets in Git? Explore practical developer news, tutorials, and tools read by millions of developers worldwide. canonical: https://daily.dev/blog/managing-your-secrets-in-git/ og:type: article og:url: https://daily.dev/blog/managing-your-secrets-in-git/ og:title: Managing your secrets in Git 🗝 | daily.dev og:description: We have always been told not to store secrets in Git. But what if I told you that we manage all our secrets in Git? Explore practical developer news, tutorials, and tools read by millions of developers worldwide. og:image: https://media.daily.dev/image/upload/s--KKBitQX0--/f_auto,q_auto/v1/recruiter-landing/5f03259e321abeff6b822a30_6yex5g2x47iuuys1csle_a6bdc84b73?_a=BAMAMiB80 og:site_name: daily.dev og:locale: en_US article:published_time: 2020-07-06 article:modified_time: 2026-05-15T14:26:34.375Z article:author: Ido Shamun twitter:card: summary_large_image twitter:site: @dailydotdev twitter:creator: @dailydotdev twitter:title: Managing your secrets in Git 🗝 | daily.dev twitter:description: We have always been told not to store secrets in Git. But what if I told you that we manage all our secrets in Git? Explore practical developer news, tutorials, and tools read by millions of developers worldwide. twitter:image: https://media.daily.dev/image/upload/s--KKBitQX0--/f_auto,q_auto/v1/recruiter-landing/5f03259e321abeff6b822a30_6yex5g2x47iuuys1csle_a6bdc84b73?_a=BAMAMiB80 --- We have always been told not to store secrets in Git. They may be revealed to a potential attacker and can be misused. But what if I told you that at [daily.dev](https://daily.dev), we manage all our secrets in Git?  Introducing [git-crypt](https://github.com/AGWA/git-crypt), a git addon that automatically encrypts and decrypts secrets upon commit and checkout. You need to define what files git-crypt (more on this later) should encrypt and it will take for the rest. The most incredible feature is that you can't even tell that the files are encrypted. The process is fully transparent to the end-user. It is compatible with git diff and all other git operations. The one single change is that now remote files are encrypted and cannot be accessed without the encryption key. Now that we can encrypt our secrets we don't have to worry about them being leaked or misused by others. git-crypt follows the best practices in terms of encryption and security. Before we dive into how exactly we can utilize this tool, let's review the pros and cons. ## Cons - Secrets cannot be edited without pulling the code. - No fancy UI to edit the secrets. - Developers need git-crypt to read and write secrets. - Secrets cannot be shared across projects easily. - When reverting the repository, the configuration will be reverted as well and this may cause an out-of-date config to be used. ## Pros - Infrastructure as code, one of my favorite design patterns. The secrets are managed in Git and thus you can apply any code workflow you are used to. Code reviews, reverts, version comparison, and more. - Secrets schema is always aligned with the application code. Secrets and application code are deployed as a single unit so even if you revert your application version, the configuration will be reverted as well, making sure the schema is compatible with the code. - Secrets cannot be shared which forces you to create a standalone config. Sharing secrets between services is just like sharing a database connection, it's a dependency the forces you to coordinate deployments. It's very hard to maintain these dependencies in the long term. - You know exactly where to find all the secrets for your application. - CI/CD can easily access the secrets. By now, you probably understand that this method is not for everyone or every use case. If you are a die-hard fan of infrastructure as code like I do, make sure to test it out. Let's try it out.  ## Installing git-crypt For Brew users, like myself, it's super easy to install: _brew install git-crypt_ The others probably have to build it from source, but worry not. It should be pretty straightforward as well. [Instructions can be found here](https://github.com/AGWA/git-crypt/blob/master/INSTALL.md). ## Initialization We need to let git-crypt initialize its environment in our repository. Navigate to your repo and run: _git-crypt init_ ## Configuration Let's open the .gitattributes file in our repo's root directory. We need to add the files and [glob patterns](https://en.wikipedia.org/wiki/Glob_\(programming\)) we would like to encrypt. Here is an example: _secretfile filter=git-crypt diff=git-crypt \*.key filter=git-crypt diff=git-crypt secretdir/\*\* filter=git-crypt diff=git-crypt_ In this example, git-crypt will manage the following files: - A file named secretfile. - All files that end with .key. - All files that are in the secretdir folder and its children. ## Adding a new collaborator This is the tricky part. You need to run this command for every collaborator of the project, including yourself. Otherwise, this person will not be able to decrypt the secrets. Note that you must have GPG installed for running this command (out of the scope of this blog post). _git-crypt add-gpg-user USER\_ID_ Once you run this command git-crypt will commit the new changes to apply them. A nice side effect, you can keep track of your collaborators through the git history. ## Unlocking an existing repo Simply run: _git-crypt unlock_ And that's it, the encrypted files are now decrypted and ready for you to edit them. ‍ That's it! 🌟 You are ready to go and store your secrets in Git. ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/og-image.png?v=a830cdf1","width":1200,"height":630},"sameAs":["https://twitter.com/dailydotdev","https://www.linkedin.com/company/dailydotdev","https://github.com/dailydotdev","https://www.instagram.com/dailydotdev"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","description":"Free, personalized developer news aggregator. Stay on top of software development news, AI coding tools, and web dev - curated daily from trusted sources.","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}},{"@type":"WebPage","@id":"https://daily.dev/blog/managing-your-secrets-in-git/","url":"https://daily.dev/blog/managing-your-secrets-in-git/","name":"Managing your secrets in Git 🗝 | daily.dev","description":"We have always been told not to store secrets in Git. But what if I told you that we manage all our secrets in Git? Explore practical developer news, tutorials, and tools read by millions of developers worldwide.","inLanguage":"en-US","isPartOf":{"@id":"https://daily.dev/#website"}},{"@type":"Article","@id":"https://daily.dev/blog/managing-your-secrets-in-git/#article","headline":"Managing your secrets in Git 🗝","url":"https://daily.dev/blog/managing-your-secrets-in-git/","datePublished":"2020-07-06","dateModified":"2026-05-15T14:26:34.375Z","isPartOf":{"@id":"https://daily.dev/#website"},"publisher":{"@id":"https://daily.dev/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/blog/managing-your-secrets-in-git/"},"description":"We have always been told not to store secrets in Git. But what if I told you that we manage all our secrets in Git? Explore practical developer news, tutorials, and tools read by millions of developers worldwide.","image":{"@type":"ImageObject","url":"https://media.daily.dev/image/upload/s--KKBitQX0--/f_auto,q_auto/v1/recruiter-landing/5f03259e321abeff6b822a30_6yex5g2x47iuuys1csle_a6bdc84b73?_a=BAMAMiB80"},"author":{"@type":"Person","name":" Ido Shamun","url":"https://app.daily.dev/idoshamun"},"potentialAction":{"@type":"ReadAction","target":"https://daily.dev/blog/managing-your-secrets-in-git/"}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://daily.dev/blog/"},{"@type":"ListItem","position":3,"name":"Security","item":"https://daily.dev/categories/security/"},{"@type":"ListItem","position":4,"name":"Managing your secrets in Git 🗝","item":"https://daily.dev/blog/managing-your-secrets-in-git/"}]}]} ```