In order to see your GitHub Secrets follow these steps:

  1. Create a workflow that echos all the secrets to a file.
  2. As the last step of the workflow, start a tmate session.
  3. Enter the GitHub Actions runner via SSH (the SSH address will be displayed in the action log) and view your secrets file.

Here is a complete working GitHub Action to do that:

name: Show Me the S3cr3tz
on: [push]

jobs:
  debug:
    name: Debug
    runs-on: ubuntu-latest

    steps:
    - name: Check out code
      uses: actions/checkout@v2

    - name: Set up secret file
      env:
        DEBUG_PASSWORD: ${{ secrets.DEBUG_PASSWORD }}
        DEBUG_SECRET_KEY: ${{ secrets.DEBUG_SECRET_KEY }}
      run: |
        echo $DEBUG_PASSWORD >> secrets.txt
        echo $DEBUG_SECRET_KEY >> secrets.txt

    - name: Run tmate
      uses: mxschmitt/action-tmate@v2

The reason for using tmate in order to allow SSH access, instead of just running cat secrets.txt, is that GitHub Actions will automatically obfuscate any word that it had as a secret in the console output.


That said - I agree with the commenters. You should normally avoid that. Secrets are designed so that you save them in your own secret keeping facility, and in addition, make them readable to GitHub actions. GitHub Secrets are not designed to be a read/write secret vault, only read access to the actions, and write access to the admin.

Answer from DannyB on Stack Overflow
🌐
GitHub
docs.github.com › en › actions › concepts › security › secrets
Secrets - GitHub Docs
Secrets allow you to store sensitive information in your organization, repository, or repository environments. Secrets are variables that you create to use in GitHub Actions workflows in an organization, repository, or repository environment.
🌐
GitHub
docs.github.com › actions › security-guides › using-secrets-in-github-actions
Using secrets in GitHub Actions - GitHub Docs
To create secrets or variables for an environment in an organization repository, you must have admin access. For more information on environments, see Managing environments for deployment. On GitHub, navigate to the main page of the repository.
Discussions

github - How can I see my git secrets unencrypted? - Stack Overflow
I had some secrets in my code and upon learning about GitHub Actions I decided to save them in the repository's secret menu for later use in my pipeline. However, now I need to access these secrets... More on stackoverflow.com
🌐 stackoverflow.com
How to see my git secrets?
Background I had some secrets in my code and upon learning about GitHub Actions I decided to save them in the repositories secret menu for later use in my pipeline. Problem However, now I need to a... More on github.com
🌐 github.com
12
9
How to Monitor GitHub for Secrets
secret-bridge looks for secrets in the CI pipeline, but did anyone write a pre-commit hook which could scan for them earlier? More on reddit.com
🌐 r/netsec
26
201
September 25, 2019
Exposing secrets on GitHub: What to do after leaking credentials and API keys
Thanks a lot for sharing! More on reddit.com
🌐 r/git
1
36
March 25, 2020
People also ask

What is GitHub Secret Protection?

GitHub Secret Protection detects and prevents secret leaks continuously in real-time, proactively blocking sensitive credentials from being pushed to a repository with push protection. With a remarkably low false positive rate and approximately 150 service provider integrations, it enables rapid credential revocation and rotation, enhancing developer productivity.

🌐
github.com
github.com › security › advanced-security › secret-protection
GitHub Secret Protection · GitHub
What is the secret scanning partnership program?

The secret scanning partnership program allows service providers to secure their token formats by enabling GitHub to scan public repositories and npm packages for exposed secrets. When a secret is found in a public repo, GitHub sends an alert directly to the service provider, who can then validate and take appropriate action.

🌐
github.com
github.com › security › advanced-security › secret-protection
GitHub Secret Protection · GitHub
What are secret scanning validity checks?

Validity checks help you determine whether detected secrets are still active, enabling developers and security teams to prioritize their response effectively. When a secret is flagged, the system verifies its validity to confirm whether the secret is active or inactive.

🌐
github.com
github.com › security › advanced-security › secret-protection
GitHub Secret Protection · GitHub
🌐
DEV Community
dev.to › pwd9000 › best-practices-for-using-github-secrets-part-1-596f
Best Practices for Using GitHub Secrets - Part 1 - DEV Community
July 18, 2024 - A guide to using native GitHub Secrets for securely storing API keys, credentials, and sensitive data in your GitHub Action workflows (Part 1 of 2). Tagged with github, tutorial, devops, devsecops.
🌐
GitHub
docs.github.com › en › get-started › learning-to-code › storing-your-secrets-safely
Storing your secrets safely - GitHub Docs
Access tokens also allow services, such as GitHub Actions, to perform tasks that need authentication, as we will experiment with later. Database credentials that grant access to local and external databases and storage. Private keys, such as private SSH and PGP keys, that can be used to access other servers and encrypt data. Since secrets provide so much access, including to critical systems, we can understand why it's so important to keep your secrets secure.
🌐
TheServerSide
theserverside.com › blog › Coffee-Talk-Java-News-Stories-and-Opinions › GitHub-Actions-Secrets-Example-Token-Tutorial
How to use GitHub Actions secrets to hide your tokens and passwords example
In summary, here are the steps to take if you would like to use a GitHub Actions secret in your continuous integration workflows: ... Reference the GitHub secret in code by prepending the text secret.
Find elsewhere
🌐
GitHub
docs.github.com › en › codespaces › managing-codespaces-for-your-organization › managing-development-environment-secrets-for-your-repository-or-organization
Managing development environment secrets for your repository or organization - GitHub Docs
For more information, see GitHub's plans. ... Development environment secrets are encrypted environment variables that you create in the GitHub Codespaces settings for an organization, a repository, or a personal account. This article explains how to manage organization secrets and repository secrets.
Top answer
1 of 11
70

In order to see your GitHub Secrets follow these steps:

  1. Create a workflow that echos all the secrets to a file.
  2. As the last step of the workflow, start a tmate session.
  3. Enter the GitHub Actions runner via SSH (the SSH address will be displayed in the action log) and view your secrets file.

Here is a complete working GitHub Action to do that:

name: Show Me the S3cr3tz
on: [push]

jobs:
  debug:
    name: Debug
    runs-on: ubuntu-latest

    steps:
    - name: Check out code
      uses: actions/checkout@v2

    - name: Set up secret file
      env:
        DEBUG_PASSWORD: ${{ secrets.DEBUG_PASSWORD }}
        DEBUG_SECRET_KEY: ${{ secrets.DEBUG_SECRET_KEY }}
      run: |
        echo $DEBUG_PASSWORD >> secrets.txt
        echo $DEBUG_SECRET_KEY >> secrets.txt

    - name: Run tmate
      uses: mxschmitt/action-tmate@v2

The reason for using tmate in order to allow SSH access, instead of just running cat secrets.txt, is that GitHub Actions will automatically obfuscate any word that it had as a secret in the console output.


That said - I agree with the commenters. You should normally avoid that. Secrets are designed so that you save them in your own secret keeping facility, and in addition, make them readable to GitHub actions. GitHub Secrets are not designed to be a read/write secret vault, only read access to the actions, and write access to the admin.

2 of 11
68

The simplest approach would be:

name: Show Me the S3cr3tz
on: [push]

jobs:
  debug:
    name: Debug
    runs-on: ubuntu-latest

    steps:
    - name: Check out code
      uses: actions/checkout@v2

    - name: Set up secret file
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        ...
        ...
      run: |
        echo ${{secrets.AWS_ACCESS_KEY_ID}} | sed 's/./& /g'
        ...
        ...

Run this action in GitHub and check its console. It displays secret key with space between each character.

🌐
GitHub
github.com › security › advanced-security › secret-protection
GitHub Secret Protection · GitHub
Detect secrets in issues, discussions, and more with secret scanning. Metadata like validity checks and public leaks help prioritize active threats. GitHub Copilot finds elusive secrets like passwords without the false positives.
🌐
Blacksmith
blacksmith.sh › blog › best-practices-for-managing-secrets-in-github-actions
Best Practices for Managing Secrets in GitHub Actions | Blacksmith
These secrets can include API keys, access tokens, database credentials, or any confidential data in your workflows that shouldn't be exposed in your code. GitHub provides three distinct levels of secret management:
🌐
Medium
saurabh-sawhney.medium.com › o-github-tell-me-your-secrets-c06130bd4c2e
O GitHub, tell me your secrets - Saurabh - Medium
November 30, 2023 - Either create and use a new secret (an API key that I could have regenerated in about 3.489 seconds), or figure out if I had it in me to be King Arthur and extract the sword from the rock. I swallowed, took a deep breath, and chose the way of the knights. The conceptual solution seemed simple at first. GitHub allows its runners to use these secrets as it executes commands.
🌐
Stepsecurity
stepsecurity.io › blog › github-actions-secrets-management-best-practices
8 GitHub Actions Secrets Management Best Practices to Follow - StepSecurity
GitHub Actions secrets are variables that enable you to store sensitive information in your repositories. These can be admin access keys, credentials, or organization secrets- all sensitive data that needs to be fully secured.
🌐
Configu
configu.com › home › github secrets: the basics and 4 critical best practices
GitHub Secrets: The Basics and 4 Critical Best Practices - Configu
January 17, 2025 - GitHub secrets are encrypted environment variables, managed within GitHub Actions. They allow you to store sensitive data, like access tokens and credentials, in a secure manner. Secrets can be stored at the level of a specific GitHub repository, ...
🌐
GitHub
docs.github.com › en › actions › reference › security › secrets
Secrets reference - GitHub Docs
Organization and repository secrets are read when a workflow run is queued, and environment secrets are read when a job referencing the environment starts. GitHub automatically redacts the following sensitive information from workflow logs.
🌐
OnboardBase
onboardbase.com › blog › github-secrets
Github Secrets: A Complete Guide
November 10, 2022 - Learn how to store sensitive environment variables with Github Secrets. If you chose GitHub like 90+ million developers and 4+ million organizations ...
🌐
GitHub
github.com › awslabs › git-secrets
GitHub - awslabs/git-secrets: Prevents you from committing secrets and credentials into git repositories · GitHub
Prevents you from committing secrets and credentials into git repositories - awslabs/git-secrets
Starred by 13.3K users
Forked by 1.2K users
Languages   Shell 65.2% | Roff 31.6% | PowerShell 2.1% | Makefile 1.1%
🌐
DEV Community
dev.to › n3wt0n › how-secrets-work-in-github-and-how-to-manage-them-p4o
How Secrets Work in GitHub and How to Manage Them - DEV Community
April 29, 2021 - GitHub lets you save your secrets, like credentials, keys, etc., and use them in GitHub Actions. Let... Tagged with github, secrets, tutorial, codenewbie.