I think even better to encrypt the password in ~/.authinfo.gpg, e.g., machine my_db login my_usr password bla-bla-123 And then in the source block header

I think even better to encrypt the password in ~/.authinfo.gpg, e.g., machine my_db login my_usr password bla-bla-123 And then in the source block header, you can inject it into a variable :var pass=(auth-source-pick-first-password :host "my_db") That's a built-in elisp function. Yes, you can call arbitrary functions to assign vars for org-mode source blocks. You can even assign shell command output, I often do things like: :var token=(shell-command-to-string "echo $MY_TOKEN") What's crazy about this shit is that you can even pipe the content of the file back into itself: #+begin_src sh :pretty :var token=(shell-command-to-string (format "grep my_token %s" buffer-file-name)) echo $token #+end_src That's an absurd bananas degree of ingenious engineering that makes you question the sanity of programmers who deliberately abandon Emacs, even after experiencing such power.