Where Git Credential Manager stores your credentials on each OS

Git Credential Manager defaults to Windows Credential Manager on Windows and the macOS Keychain on macOS. Linux has no default, so you must choose a store. Avoid the plaintext option on a laptop. Check which store you are using before you assume your tokens are protected.

The options per OS

From the Git Credential Manager documentation:

Windows

• Windows Credential Manager, the default.
• DPAPI protected files.
• Plaintext files.
• Passthrough, which stores nothing.

macOS

• macOS Keychain, the default.
• GPG or pass compatible files.
• Git's built-in credential cache.
• Plaintext files.
• Passthrough.

Linux

• The freedesktop.org Secret Service API, which needs a D-Bus session and a provider such as GNOME Keyring or KWallet.
• GPG or pass compatible files.
• Git's built-in credential cache.
• Plaintext files.
• Passthrough.

Linux needs a decision

The documentation says Linux has no default store. You select one with the GCM_CREDENTIAL_STORE environment variable or the credential.credentialStore Git setting.

That is easy to miss. If nothing is set, you have not chosen anything, and you may be prompted repeatedly or end up with a fallback you did not intend.

Which to pick

A reasonable order for a laptop:

1. The OS-native store: Credential Manager, Keychain, or Secret Service with a keyring.
2. GPG or pass compatible files, if you already use a GPG-based password store and want the secret under your own key.
3. Git's built-in credential cache, if you want credentials held only for a short time. I cannot confirm its exact timeout from the page used here, so check Git's documentation.
4. Avoid plaintext files. Anyone or anything that can read your home directory can read the token.
5. Passthrough is useful in automation where a different mechanism supplies credentials.

Headless and remote machines

The Secret Service option needs a D-Bus session and a provider. On a remote server over SSH, or a minimal container, neither may exist. In those places pick a method that does not depend on a desktop session, and prefer short-lived tokens.

Housekeeping

• Use tokens with narrow scopes and short lives where your host supports it.
• When you lose a laptop, revoke its tokens. Disk encryption helps, but revocation closes the question.
• Look at what is stored. On macOS, open Keychain Access and search for your Git host. On Windows, open Credential Manager.
• Do not put tokens in remote URLs, since those end up in shell history and Git config.

Related checks

Credentials are one place secrets leak from a developer machine. Another is your repositories. Safeguard's free scan at gold.safeguard.sh/scan looks at the dependencies in a repository, so pair it with a secret scanner of your choice for committed credentials.

Quick check

Sources

• Git Credential Manager: credential stores (GitHub)

Last reviewed: 19 October 2026.