Where apps hide your files

Git config and credential files

Updated 2026-10-28 · 5 min read

Git reads settings from several files, and on a Mac your saved passwords usually are not in any of them. This shows each location, how to confirm which one is winning, and where credentials really live.

The locations

~/.gitconfig                  global (your user settings)
~/.config/git/config          global, alternative location (also ~/.config/git/ignore)
<repo>/.git/config            per repository

Git reads both global files if both exist, ~/.config/git/config first, so a value in ~/.gitconfig wins. Most people only have ~/.gitconfig.

Above those sit files that come with Git itself, and they depend on how Git was installed:

• Apple's Git (from Xcode or the Command Line Tools, at /usr/bin/git) reads an extra file inside the developer folder, /Applications/Xcode.app/Contents/Developer/usr/share/git-core/gitconfig with Xcode, or /Library/Developer/CommandLineTools/usr/share/git-core/gitconfig with the Command Line Tools. That file sets the Keychain credential helper. Git's standard system file, /etc/gitconfig, usually does not exist on a Mac.
• Homebrew Git uses $(brew --prefix)/etc/gitconfig as its system file, which is /opt/homebrew/etc/gitconfig on Apple silicon and /usr/local/etc/gitconfig on Intel. Homebrew's formula writes the same Keychain helper setting into it.

Run xcode-select -p to see which developer folder Apple's Git uses. Everything above is a plain text file you can open in any editor. ~/.gitconfig starts with a dot, so press ⇧⌘. in Finder to see it, or use ⇧⌘G and type the path.

Ask Git instead of guessing

Because there are several layers, the quickest way to find the file that sets a value is:

git config --list --show-origin --name-only

Each line starts with the file that defined the setting, and --name-only prints the setting names without values, which keeps tokens out of your terminal. Add --show-scope to label each line global, local and so on; Apple's developer-folder file shows up with the scope unknown. To see where one key comes from, run git config --show-origin --get user.email. Git's documentation says the files are read in order, system, global, then the repository's .git/config, with the last value found taking precedence, and -c options on the command line override them all.

Git also supports conditional files. An includeIf line in ~/.gitconfig pulls in another file for repos under a certain folder, which is how people keep separate work and personal identities. If a value is coming from somewhere unexpected, the --show-origin output names that file.

Where the credentials are

Git has no password file of its own. It asks a credential helper. Apple's Git sets the helper to osxkeychain in that developer-folder file, so passwords and personal access tokens for HTTPS remotes are stored in your login keychain, not in ~/.gitconfig. Open Keychain Access and search for github.com to see the entry, listed as an internet password. On macOS Sequoia, Keychain Access is no longer in the Utilities folder; open it with Spotlight, or find it at /System/Library/CoreServices/Applications/Keychain Access.app.

Confirm which helper is active, and which file set it, with:

git config --show-origin --get-all credential.helper

Two other helpers show up often. The GitHub CLI (gh auth setup-git) adds [credential "https://github.com"] sections with a helper line that calls gh auth git-credential, and the token is then held by gh rather than written into your Git config. The store helper writes a plaintext file at ~/.git-credentials, one URL per line with the username and token embedded. It exists only if someone set credential.helper store. If you have this file, treat it as a secret: the permissions should be -rw-------, and you should never paste its contents anywhere. Check with ls -la ~/.git-credentials, which shows size and mode without reading it.

Moving from store to the Keychain is a two step job: remove the store line with git config --global --unset credential.helper (Apple's Git already supplies osxkeychain; with another Git, run git config --global credential.helper osxkeychain instead), push once so the Keychain saves your login, then move ~/.git-credentials to the Trash in Finder.

Which file should you edit

Use git config --global user.name "Your Name" and similar commands rather than editing by hand when you can, because Git writes the right file for you. Edit ~/.gitconfig directly only for bigger changes such as aliases or includeIf blocks, and run git config --global --list --name-only afterwards to check that it still parses. A typo in a section header makes every git command fail with a "bad config line" message that names the file and line.

SSH keys are a separate thing

Remotes that use git@github.com:... do not use the credential helper at all. They use keys in ~/.ssh and the ~/.ssh/config file, covered in the SSH keys post linked below.

Ignore files, templates and hooks

File	What it does
~/.config/git/ignore	Default global ignore list, read with no setup
~/.gitignore_global	A common name for an ignore file, used only if core.excludesFile points to it
~/.gitmessage	Commit message template, used only if commit.template points to it
<repo>/.git/hooks/	Per-repository hooks; core.hooksPath can redirect them to one shared folder

If a global ignore rule seems to apply and you cannot see where it comes from, run git config --show-origin --get core.excludesFile and check the default location above. A rule that hides a file from git status never deletes it, so the file is still on disk.

Backing up and moving to a new Mac

Copy ~/.gitconfig and ~/.config/git/ to the new Mac. This carries your name, email, aliases and ignore rules. Credentials do not come along by copying a config file. Migration Assistant moves your login keychain with your account; otherwise you simply sign in again the first time you push. Copy ~/.git-credentials only if you use the store helper, and remove it from the old Mac afterwards.

Before sharing your config on a forum or in a dotfiles repo, scan it for token, password and url lines. A URL such as https://user:token@host/ inside .git/config is a common leak. Inside a repository, grep -c '://[^/]*@' .git/config counts such lines without printing them; anything above 0 needs a look.

Finding config files by name

~/.gitconfig and ~/.git-credentials are hidden dot-files, which Spotlight does not return. In Everywhere, typing gitconfig lists the global file, Xcode's and the Command Line Tools' copies, and any Homebrew one together, while .git-credentials tells you at once whether a plaintext credential file exists. Press ⌘↵ to reveal one in Finder. It searches names only, so use git config --list --show-origin --name-only to see what is inside.

Common questions

Where is the Git config file on a Mac?

The global file is ~/.gitconfig in your home folder (or ~/.config/git/config). Each repository also has its own .git/config, and Apple's Git adds one inside the Xcode or Command Line Tools folder.

Where does Git store my GitHub password or token on a Mac?

With the default osxkeychain helper it is in your login keychain, as an internet password for github.com. Only the store helper writes a plaintext ~/.git-credentials file.

How do I find which file sets a Git option?

Run git config --show-origin --get <key> for one setting, or git config --list --show-origin --name-only for all of them.

How do I reset saved Git credentials on a Mac?

Delete the github.com internet password in Keychain Access, then push again. Git asks for a login and the helper stores the new one.