hide credentials in a safe place