Python Quick Tip: Hiding Passwords and Secret Keys in Environment Variables (Windows)

Hardcoding passwords and secret API keys directly in Python code is a common beginner mistake—and it becomes dangerous fast when code is shared with a team or pushed to a repository. A safer pattern is to store secrets in environment variables on the machine running the code, so the source code can be shared without exposing credentials.

On Windows, environment variables are set through the Control Panel. The process starts by opening the Windows search, launching Control Panel, then going to System and Security → System. From there, Advanced system settings leads to the Environment Variables button. In that dialog, secrets can be added as either user variables or system variables; the walkthrough uses user variables. New variables are created with names like DB_USER and DB_PASS (the tutorial prefers all-caps for clarity), and their values are copied from the placeholders that previously lived inside the Python script.

After saving the variables, the change may not apply immediately to an already-open development environment. The tutorial specifically notes that restarting the IDE or editor (it uses Sublime Text) ensures the updated environment is visible to the running Python process.

In Python, the secrets are retrieved at runtime using the standard library’s OS module. Importing OS enables access to environment variables via os.environ, which behaves like a dictionary. Each secret is fetched by key—e.g., os.environ['DB_USER'] for the database username and os.environ['DB_PASS'] for the database password. When the script runs, it prints or uses the retrieved values without those credentials being embedded in the code itself.

The practical payoff is straightforward: sharing the script no longer shares the secrets. Anyone who receives the code sees only the environment-variable lookups, while the actual credentials remain stored locally on the machine where the variables were defined. The tutorial also points out that setting environment variables differs across operating systems, and it references a separate walkthrough for Mac and Linux.

Overall, the method is a quick, low-friction way to reduce accidental credential leaks during collaboration and version control—especially for developers who are still learning good security hygiene. It doesn’t replace more advanced secret-management systems, but it addresses the immediate risk of committing or distributing secrets alongside application code.