I am cloning a git repository in a script like this:

git clone https://user:[email protected]/name/.git

This works, but my username and my password! are now stored in the origin url in .git/config.

How can I prevent this, but still do this in a script (so no manual password input)?

  • You could probably update the origin afterwards: git remote set-url origin https://host.com/name/.git
    – ceejayoz
    Commented Nov 15, 2016 at 15:37
  • @ceejayoz Yes, thats possible. Thanks for the Idea. I am still hopening for a solution, that does not even temporary store the credentials.
    – Nathan
    Commented Nov 15, 2016 at 15:39
  • 4
    Sure - use SSH-based auth with a key.
    – ceejayoz
    Commented Nov 15, 2016 at 16:13
  • 2
    Is there a reason you use https instead of SSH? SSH supports keys.
    – mzhaase
    Commented Nov 15, 2016 at 16:17
  • 1
    @MartijnCourteaux The password is actually given to the script through an enviornment variable. So I actually do: git clone username:$PASSWORD@...
    – Nathan
    Commented Nov 16, 2016 at 7:12

5 Answers 5


The method that I use is to actually use a git pull instead of a clone. The script would look like:

mkdir repo
cd repo
git init
git config user.email "email"
git config user.name "user"
git pull https://user:[email protected]/name/repo.git master

This will not store your username or password in .git/config. However, unless other steps are taken, the plaintext username and password will be visible while the process is running from commands that show current processes (e.g. ps).

As brought up in the comments, since this method is using HTTPS you must URL-encode any special characters that may appear in your password as well.

One further suggestion I would make (if you can't use ssh) is to actually use an OAuth token instead of plaintext username/password as it is slightly more secure. You can generate an OAuth token from your profile settings: https://github.com/settings/tokens.

Then using that token the pull command would be

git pull https://$OAUTH_TOKEN:[email protected]/name/repo.git master
  • Unofrtantly I cannot use auth tokens. I am not using github but a private server.
    – Nathan
    Commented Nov 16, 2016 at 7:20
  • 3
    Should also be noted that the username and password will be visible in, e.g., ps while the pull runs (at least unless you've prevented users from seeing each others' processes)
    – derobert
    Commented Nov 21, 2016 at 17:30
  • Points for oath usage. It's exactly what I needed in production/staging/dev. Commented Sep 11, 2018 at 14:39
  • a million thanks to you buddy. wasted hours n hours n finally your answer came to resue. :thumbsup Commented Feb 28, 2019 at 15:07
  • 1
    Note that in this solution reserved characters need to be escaped. e.g. myp@ssword should be provided as: myp%40ssword
    – Marinos An
    Commented Jan 7, 2020 at 13:12

IMO the best solution is using a custom GIT_ASKPASS helper and deliver the password as another environment variable. So for example, create a file git-askpass-helper.sh as:

exec echo "$GIT_PASSWORD"

and then run git clone https://username@hostname/repo with environment variables GIT_ASKPASS=/path/to/git-askpass-helper.sh and GIT_PASSWORD=nuclearlaunchcodes.

This has the advantage that the password won't be visible in the process list too.

  • +1 for creative solution. This would be a little more secure than the git pull solution and allow you to store the plaintext password as a secret in your automated deploy tool of choice.
    – FGreg
    Commented Jun 14, 2018 at 17:43
  • 1
    Did not work. Still asks for a password on git clone
    – Marinos An
    Commented Dec 18, 2019 at 15:13
  • Any way to make it work in windows? I think i saw the solution to replace the .sh file with exe, but i do not want to (Cannot stress enough) commit an exe into my repo
    – Pranav Raj
    Commented Feb 4, 2020 at 21:26
  • @PranavRaj I think you should be able to port it to a .bat or .cmd file as well but I'm not familiar with that syntax.
    – intgr
    Commented Feb 5, 2020 at 13:56
  • For anyone else looking for a cross platform solution: I used the github.com/libgit2/libgit2sharp/wiki nuget package and I was able to build a .net core app which worked on both windows and linux :) Instead of storing the password in my code, I stored it in the key vault and inside the code accessed the secret - so not saving git password as a plain text anywhere :)
    – Pranav Raj
    Commented Feb 5, 2020 at 20:16

After going over dozens of SO posts, blogs, etc, I tried out every method, and this is what I came up with. It covers EVERYTHING.

See The Git Credentials & Private Packages Cheatsheet

These are all the ways and tools by which you can securely authenticate git to clone a repository without an interactive password prompt.

  • SSH Public Keys
  • API Access Tokens
    • .gitconfig insteadOf
    • .gitconfig [credential]
    • .git-credentials
    • .netrc
  • Bonus: Works with Private Packages
    • node / npm package.json
    • python / pip / eggs requirements.txt
    • ruby gems Gemfile
    • golang go.mod

Best options for no plaintext storage

From what's asked here either SSH Keys, GIT_ASKPASS, or git credential store using the OS Keychain manager might be the best choice.

Since GIT_ASKPASS is probably the least understood of the 3, I'll detail that here - and the others are in the cheatsheet.


How to create an GIT_ASKPASS script:

echo 'echo $MY_GIT_TOKEN' > $HOME/.git-askpass

How to use it:

export MY_GIT_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
export GIT_ASKPASS=$HOME/.git-askpass
git clone https://[email protected]/project.git

The script receives stdin in the form of:

Password for 'scheme://host.tld':

The script receives Git ENVs such as:


More details in the cheatsheet.


You can enter your connection creds in your ~/.netrc file. Something along the lines of:

machine host.example.net
login bart
password eatmyshorts

Just make sure to chmod that file to 600. If you're using windows, the following link may be useful: https://stackoverflow.com/questions/6031214/git-how-to-use-netrc-file-on-windows-to-save-user-and-password

Personally, I have a tendency to use SSH keys for auth purposes (if you are allowed, of course).

  • Well, this would leave my password inside ~/.netrc. I Also do not want that.
    – Nathan
    Commented Nov 16, 2016 at 7:14
  • this worked for me, when GIT_ASKPASS suggestion above failed; thanks.
    – Paul M
    Commented Mar 25, 2020 at 23:50

Store your token or password somewhere safe, e.g. pass.

Then use a bash script to map git host to your password store, e.g.:

#!/usr/bin/env bash
# assuming "get" action from git and a config like this
# git config --global credential.helper $XDG_BIN_HOME'/git_credentials_from_pass $@'
while IFS= read -r line
  echo "$line"
  if [[ "$line" =~ host=.*github.com.* ]]; then
      echo "username=your_user_name"
      echo "password=$(pass show token_github.com/your_username)"
  #else ...

Change your_username and token_github.com the way you set it up.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .