How to handle application password in Git repo
You should not store secrets unencrypted in a Git repository.  Anyone who obtains a copy of that repository can get access to those secrets.  Even if the repository is private, sometimes unauthorized users get access to repositories, and you definitely want to limit the possible damage.
Base64-encoding secrets does not hide them, so you should not use that option.  The best way to set up an SSH connection would be to generate a key without a passphrase and store it in your CI secret store, and then in your CI job saving it to a temporary file and using it with ssh -i.
If that's not possible, you can use a password with your pyexpect option and store that in your CI secret store.
I have to set up a ssh connection using python. I am using the pexpect module to which I need to pass user credentials.
I keep my code in a Git repo. How can I handle the password?
Should I - 

Encode it with baseurl64 or
Keep it in the Jenkins password manager?

What are the best standards you follow?