Passwords and secrets

Lesson 1 showed that reused passwords and leaked keys are the most likely ways in. This lesson fixes both: a system for passwords you never have to remember, and the habits that keep API keys and tokens where they belong.

Passwords: unique, long, stored for you

The rule is simple: every account gets its own password. Then a breach on one site cannot open any other. Nobody can remember fifty unique passwords, so you let a password manager do it.

A password manager is an app that stores your passwords in an encrypted vault, opened with one master password. It generates a new random password for each site and fills it in for you. Most browsers have one built in, and there are dedicated apps.

          one master password (long, memorable, used nowhere else)
                         │
                         ▼
               ┌───────────────────┐
               │  encrypted vault  │
               ├───────────────────┤
               │ mail     q7#Lm…   │
               │ github   Zr4!tp…  │
               │ forum    8vWn$k…  │
               └───────────────────┘
          a different random password for every site

What makes a password strong is mostly length and randomness, not clever symbols. For the few passwords you must type from memory (the master password, your computer login), use a passphrase: four or more random words, such as copper lantern orbit pickle. It is long, quick to type, and hard to guess.

A bonus: a password manager fills in a password only on the exact site it was saved for. On a phishing copy at a look-alike address it offers nothing, which is a useful warning.

Two-factor sign-in

Two-factor authentication (2FA) asks for something extra besides the password, so a stolen password alone is not enough.

Second factor	How it works	How strong
Security key or passkey	A hardware key or your device proves who you are with cryptography, and only to the real site	Strongest. Phishing pages cannot use it
Authenticator app	An app shows a six-digit code that changes every 30 seconds	Strong. A phishing page can still ask you to type the code, so check the address
SMS code	A code arrives by text message	Better than nothing. A phone number can be moved to an attacker's SIM card

Turn on 2FA first on your email (it can reset every other password), then on code hosting, cloud accounts, banking and your password manager. Save the recovery codes the site gives you, in your password manager or on paper.

API keys and tokens: passwords for programs

Programs sign in too. An API key or token is a long random string that a program sends with each request to prove who it is, usually in a header:

GET https://api.example.com/orders
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.EXAMPLE.EXAMPLE

Anyone who has that string can do whatever the key is allowed to do: read your data, spend your cloud credit, push to your repository. Treat it exactly like a password. Other secrets of the same kind:

• Database connection strings with a password inside, such as postgres://app:PASSWORD@db:5432/shop.
• Private keys: SSH keys, TLS keys, signing keys. Anything starting -----BEGIN … PRIVATE KEY-----.
• Seed phrases for crypto wallets. In Kilonova, the 16 or 25 words of the seed are the master key: anyone who has them can take every coin in the wallet, without your password. Write them on paper, keep them offline, and never type them into a website or a chat. See Back up your wallets.

Two habits make a leaked key less harmful:

• Least privilege: give each key only the permissions it needs. A key that can only read cannot delete.
• Expiry: create keys that expire when the job is done.

Where secrets leak

Secrets rarely leak through clever hacking. They leak through ordinary sharing:

Where	How it happens	Habit that prevents it
Commits	A .env or config file with a key is committed and pushed	List .env in .gitignore; scan before pushing
Screenshots and screen shares	A terminal or settings page shows a token	Hide or blur values before you capture; close the tab before sharing your screen
Chats and AI tools	A config or log is pasted into a chat, a forum post or an AI chat	Replace values with placeholders first. Cloakpaste does this for pastes into AI chats
Logs	The app prints full request headers, including Authorization	Do not log secrets; mask them
Exported files	A collection or environment export contains tokens	Check the file before sharing (see below)
Bug reports	A crash report includes environment variables	Read the report before you attach it

A file you deleted is still in Git

Deleting a secret in a new commit does not remove it from the repository. Git keeps every version of every file. Here a token was committed, then the file was untracked and added to .gitignore:

git log --oneline

9c258bc Stop tracking .env
0f87312 Add app

git show HEAD~1:.env

API_TOKEN=ghp_EXAMPLEEXAMPLEEXAMPLE1111111111111111

The token is still one command away, for anyone who has a copy of the repository. (This one is a fake.) The Git track explains history in detail.

A secret leaked: rotate first, then clean up

When a secret has been exposed, assume someone has it. The order of the steps matters:

1. Rotate it. Go to the service that issued the key and revoke it (switch it off), then create a new one. This is the step that actually protects you, so do it first, before anything else.

2. Update what uses it. Put the new key wherever the old one was used: your app's environment, your CI secrets, your teammates' setups.

3. Check for misuse. Look at the service's activity log or billing for anything you did not do while the key was exposed.

4. Clean up. Remove the secret from the code, and add the file to .gitignore. Rewriting Git history to remove it is possible, but copies, forks and caches may already have it, which is why step 1 comes first.

5. Prevent the next one. Add a secret scan before pushing, or in CI. Lesson 5 shows how.

DANGER

Cleaning up without rotating leaves a working key in the attacker's hands. A key that has been revoked is harmless wherever it ends up.

Secret variables in ApiWorkbench

ApiWorkbench keeps tokens in variables so they are not typed into every request. Two features help keep them private:

• Initial and current values. Each variable has an Initial value, which is meant to be shared and is saved with exports, and a Current value, which is your own. Put a placeholder or nothing in Initial value and your real token in Current value.
• Secret type. Set a variable's Type to Secret and its value is shown as dots in the variable editor and hidden in the Console.

Variable	Initial value	Current value
baseUrl	https://api.example.com
token	(empty)	eyJhbGci…

Two limits to know. Secret means hidden, not encrypted: the value is stored as plain text in the app's data files on your device. And exported files are plain text: when you export, values are written as they are, so leave Include current values off (the default) and check the file before you send it. See Variables and environments and Export and share. The lab includes a check of an export.

Stay safe

• One password manager, one strong master passphrase, 2FA on your email first.
• Never put a real secret in code, a screenshot, a chat or a ticket. Use a placeholder such as YOUR_TOKEN_HERE.
• Keep a .env.example with empty values in the repository, and the real .env out of it.
• When a secret leaks: rotate, update, check, clean up, prevent. In that order.

Check yourself

QuizPasswords and secrets

Question 1 of 6

Why does a password manager make you safer even if you never write a password down?

Score: 0

What you learned

• Unique passwords from a password manager stop one breach from opening every account; 2FA stops a stolen password alone.
• API keys, tokens, connection strings, private keys and seed phrases are all secrets, and leak mostly through commits, screenshots, chats, logs and exports.
• A deleted file stays in Git history, so a leaked secret must be revoked and replaced first, then cleaned up.

Next steps

• Lesson 3: Safe networks
• What Cloakpaste detects
• Use SSH keys in SecureShell Go