To replace all text listed in passwords.txt wherever it can be found in your repository's history, run: bfg --delete-files YOUR-FILE-WITH-SENSITIVE-DATA