For a Linux service managed by systemd, use a credential file instead of an environment variable for sensitive inputs. systemd makes each credential available to the service as a file under $CREDENTIALS_DIRECTORY; with LoadCredentialEncrypted=, the deployed artifact is encrypted and systemd decrypts it when the service starts. The application still receives plaintext at runtime, so this improves delivery and exposure boundaries rather than making the secret inaccessible to the service.
What systemd credentials do—and what they do not
A systemd credential is an immutable, activation-scoped data item that the service manager supplies to a unit as a file. The credential name is the file name, and the directory is given to the service in CREDENTIALS_DIRECTORY. The systemd project describes credentials as an alternative to environment variables and simple unencrypted files for sensitive service inputs (systemd Credentials documentation).
Environment variables remain useful for ordinary configuration, but are a poor default for secrets: they are inherited by child processes by default, have size limits, and are awkward for binary data. A credential is read as a file, with a kernel access check when it is accessed, rather than being copied into every child process’s environment. This narrows the delivery path; it does not prevent the application or a sufficiently privileged process from reading the secret.
The project documentation puts the lifecycle succinctly: “Service credentials are acquired at the moment of service activation, and released on service deactivation.”
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match#1 Best Overall
Choose how the unit receives the credential
Use LoadCredential= when the source is already a plaintext file in appropriately protected storage. Use LoadCredentialEncrypted= when you want an encrypted credential artifact on disk or in a deployment bundle. For either method, the application reads the resulting file from the credential directory.
| Unit setting | Source | What happens at activation |
|---|---|---|
LoadCredential=name:/path/to/source |
A protected plaintext file | systemd supplies the credential file to the service. |
LoadCredentialEncrypted=name:/path/to/file.cred |
An encrypted systemd credential | systemd decrypts and authenticates it, then supplies plaintext to the service. A decryption or authentication failure causes the service to fail. |
Encrypted loading changes the protection of the stored or deployed representation, not the application’s runtime requirement for plaintext. Decide based on where the source is stored, whether encrypted deployment artifacts are needed, whether provisioning can access the chosen key, and how the value will be rotated or recovered.
Encrypt and load a credential
For the ordinary system service manager, a basic workflow is to encrypt the input using the same name that the unit will load, store the resulting ciphertext in an appropriately protected deployment location, then reference it with LoadCredentialEncrypted=. For example, if the service expects a credential named api-token, use that name when creating and loading the encrypted item. The name is embedded in the encrypted data to help prevent silent reuse for a different purpose.
Rank #2
-
Check the installed
systemd-creds --helpand local manual for available options and defaults. These vary by systemd release; upstream’s current manual source notes a v262 change related to pinning encrypted credentials to the TPM2 Storage Root Key (systemd-creds manual source).Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Encrypt the source file with
systemd-creds encrypt, specifying the credential name and key mode appropriate to the target system. Keep the resulting.credfile in the intended protected deployment location; do not assume ciphertext can be copied to another host. -
Add
LoadCredentialEncrypted=api-token:/path/to/api-token.credunder the service’s[Service]section. The path on the right must be readable by the service manager at activation. -
Have the application read
$CREDENTIALS_DIRECTORY/api-token. If the application accepts a file path but does not itself inspectCREDENTIALS_DIRECTORY, pass a path based on the%dcredential-directory specifier in the unit, following the syntax expected by that application’s option.
For a per-user service manager, the upstream manual says to encrypt the credential with systemd-creds encrypt --user. System-manager credentials use the ordinary system target. Do not hardcode /run/credentials/<unit>: relying on CREDENTIALS_DIRECTORY or %d also works for user services (systemd.exec manual source).
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Select a key mode for portability and recovery
systemd-creds supports encryption and authentication using a TPM2-derived key, a host key stored in /var/lib/systemd/credential.secret, or a combination. The manual describes AES256-GCM for confidentiality and integrity. The root-only host key ties a credential to access to that OS installation. With TPM2 and persistent host storage available, automatic mode ordinarily combines them, so decryption depends on both the local hardware and the operating-system installation (systemd-creds manual source).
| Key approach | Operational consequence | Consider it when |
|---|---|---|
| TPM2-derived | Intentionally machine-bound; moving the credential requires a compatible provisioning and recovery plan. | The secret should be tied to hardware and the target system manager can access the TPM. |
| Host key | Depends on preserving the host installation’s /var/lib/systemd/credential.secret; losing or replacing it can strand encrypted credentials. |
Binding to the host installation is suitable and its key lifecycle is managed. |
| Combined TPM2 and host key | Ordinarily requires both the local hardware and OS installation, tightening binding while making migration or recovery more involved. | Both hardware and installation binding are intended, and reissuance is planned. |
Before choosing, answer three operational questions: should the secret travel to another machine, what happens when hardware or the OS installation is replaced, and who provisions or preserves the keys? Verify the actual defaults and switches in the installed manual rather than assuming they match an example written for another systemd release.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Limit who can see credentials at runtime
Credentials are decrypted for the service when it starts. The running service must be able to use the plaintext, so systemd-creds cannot prevent that service from disclosing or misusing its own secret. Pair credential delivery with least privilege and service sandboxing.
-
Enable mount namespacing for services that process credentials. The systemd project identifies
PrivateMounts=as a minimal way to make the service’s runtime credential directory invisible to other services; several other sandboxing settings imply private mounts (systemd Credentials documentation).Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Do not put a sensitive literal in
SetCredential=. Unit files are world-readable; reserve this setting for non-sensitive values. UseSetCredentialEncrypted=for an encrypted literal payload when embedding ciphertext in a unit is appropriate. -
Do not treat null-key mode as secure encryption. It is a provisioning convenience and provides neither confidentiality nor authenticity.
-
Avoid passing sensitive values through the kernel command line: command-line values can be visible to userspace through
/proc/cmdline.
Handle image cloning and machine rebuilds deliberately
A prepared system image should not ship with a shared /var/lib/systemd/credential.secret. The systemd image-building guidance says to remove it so cloned instances do not share the same secret. But removing the key also makes credentials encrypted with that old key inaccessible. Provision or re-encrypt credentials during instance setup; cloned ciphertext is not automatically portable (Safely Building Images).
For generators that run before /var is mounted, the project recommends an initrd-compatible key choice such as auto-initrd when that is the intended boot flow. This is a specialized case; most ordinary services should select a mode based on their host, hardware, and recovery requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
