OneTaskBy Tim King · Updated
Remove Secrets From Git History
Purge a Committed API Key or .env File With git filter-repo or BFG
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Git Secret Removal Guide works
This guide gives you the exact steps to remove secrets from git history after a password, API key or .env file has been committed. Enter the file paths or leaked values, one per line, and choose where the repository lives to get commands you can copy in order.
How to remove secrets from git history properly
Deleting the file in a new commit does not help, as every earlier commit still holds it and anyone can check it out. The only real fix for the secret itself is to revoke it and issue a new one. Rewriting history comes second, to stop the old value lying around in clones and archives.
The steps start with rotation, then a fresh mirror clone to work in. git filter-repo is the tool the git project recommends. It removes paths from every commit, or replaces leaked text with REMOVED when a value sat inside a file you need to keep. BFG Repo-Cleaner is an older Java alternative that matches file names rather than paths and leaves your latest commit untouched.
After checking the secret is gone, you force-push and ask the host to drop cached copies, as GitHub keeps pull request refs and forks keep their own history. Everyone with a clone must clone again, or an old copy will bring the secret back. Commands are built from your input and nothing is sent anywhere.
FAQ
Is rewriting history enough on its own?
No. Bots scan public pushes for keys within minutes, and anyone who cloned or forked the repository still has the old commits. Always revoke and replace the secret first, then clean the history.
Should I use git filter-repo or BFG?
git filter-repo is faster, maintained and recommended by the git project, and it matches full paths. BFG is simpler if you already have Java, but it matches names only and protects your latest commit.
Will this break other people's clones?
Yes. Every commit after the first one touched gets a new ID, so existing clones no longer match. Warn your team before force-pushing and ask them to clone fresh rather than pull or merge.
How do I stop this happening again?
Add .env and key files to .gitignore, keep secrets in environment variables or a secrets manager, and run a scanner such as gitleaks as a pre-commit hook so a secret is caught before it is committed.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Secret Scanner
Find leaked API keys, tokens and passwords in pasted code.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.
Git Cheat Sheet
Find the right git command and whether it is safe to run.
API Key Generator
Random prefixed API keys with an optional checksum, like GitHub tokens.
Incident Response Checklist
A step-by-step checklist for the security incident you are facing.