* Keeping secrets in your password manager (all major password managers are supported), see https://www.chezmoi.io/user-guide/password-managers/.
* Encrypting entire files with gpg or age, see https://www.chezmoi.io/user-guide/encryption/.
You can also bootstrap your gpg/age private key on a new machine with a passphrase, see https://www.chezmoi.io/user-guide/frequently-asked-questions....