How to remove a file from Git history
Łukasz Holeczek
Follow Łukasz Holeczek on GitHub
Connect with Łukasz Holeczek on LinkedIn
Follow Łukasz Holeczek on X (Twitter)
Removing sensitive files like passwords or API keys from Git history is critical for security when they’re accidentally committed.
As the creator of CoreUI with over 25 years of development experience, I’ve helped teams clean repositories after accidental credential commits many times.
The most effective modern solution is to use git filter-repo, which is faster and safer than the older filter-branch command.
This tool completely rewrites history to remove all traces of the file.
Use git filter-repo to completely remove a file from Git history.
# Install git-filter-repo first
pip install git-filter-repo
# Remove file from entire history
git filter-repo --path secrets.env --invert-paths
# Force push to update remote
git push origin --force --all
The git filter-repo command with --path specifies which file to target, and --invert-paths removes it instead of keeping it. This rewrites every commit in your repository’s history, removing all traces of the file. After running this command, you must force push to update the remote repository. Important: this rewrites commit hashes, so all team members must re-clone the repository.
Best Practice Note
This is the same cleanup approach we use for CoreUI projects when sensitive data is accidentally committed. Before running this command, ensure all team members have pushed their work and are aware of the history rewrite. After cleaning, rotate any exposed credentials immediately, as the file may still exist in cloned repositories or CI/CD caches.
