Docker stores registry logins in the credential store you configured. If you have not configured one, it writes them to config.json in your Docker config folder, base64 encoded. Base64 is encoding, not encryption, so anyone or anything that can read that file can recover the credential.
Where the file lives
Docker's login documentation says the config file is at $HOME/.docker/config.json on Linux, or %USERPROFILE%/.docker/config.json on Windows. If you do not configure a credential store, credentials are kept in that file in base64 encoded form. The documentation states plainly that this method is less secure than using a credential store.
If you use Docker Desktop, the credential store is already installed and configured for you, so you can skip the setup unless you want to change it.
What a credential store changes
The Docker Engine can keep credentials in an external store such as the native keychain of the operating system. The documentation lists helpers for the D-Bus Secret Service, the Apple macOS keychain, the Microsoft Windows Credential Manager and pass. Using an external store is described as more secure than the configuration file.
With a store configured, config.json names the helper instead of holding the secret.
How to check your own machine
- Open the config file and look for an auth entry with a long string, and for a field naming a credential store or helpers.
- If you see encoded auth values and no store, decode one to confirm what is in there. You will find the username and password or token in readable form.
- Log out of the registry, install the helper for your platform, set it in the config, and log in again.
- Delete the old encoded values if any remain, and revoke any token that sat there for a long time.
Choose tokens, not passwords
The documentation notes you can authenticate with a username and an access token or password. Use an access token with the smallest scope your task needs. For Docker Hub, the login command can use a web based sign in flow that signs you in without entering your password.
Why this belongs on a hygiene list
Container credentials are easy to forget because they are set once and used by scripts. They often grant push access to images that other people deploy. A stolen push token lets someone replace an image you own, which turns a laptop compromise into a supply chain problem.
Check the same folder after any laptop restore or migration. Copying a home directory to a new machine also copies the file.
Shared and CI machines
Build hosts deserve the same check. A shared machine with a single config.json holds the login for everyone who uses it. Prefer short lived tokens injected per job, and make sure the config file is not baked into an image or cached between unrelated builds.
If you want a quick look at what your projects actually resolve, Safeguard offers SBOM and dependency scanning, and there is a free scan at gold.safeguard.sh/scan.
Click through it at your own pace, or open it full screen.
Quick check
Is base64 the same as encrypted?
No. Base64 is a reversible encoding. Anyone who can read config.json can decode the value.
Do Docker Desktop users need to configure a store?
Per the Docker documentation, Docker Desktop already has the credential store installed and configured unless you want to change it.
Sources
Last reviewed: 19 October 2026.
