Take the 2-minute tour ×

how do you secure your passwords in propertie Files? Encryption / Encoding?

Or do you use a different approach to handle Database User / Passwords for connection Strings?

Thanks for you help!

Update: Thanks for your responses! In this special case we talk about two tier architecture. We have many clients with direct connections to the databases. Propertie Files are on a network share.

share|improve this question
add comment

4 Answers

For connection strings to database I use mostly jndi connections. And there I can encrypt the passwords: http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#Digested_Passwords

share|improve this answer
add comment

you might have a closer look to aspnet_regiis. This commandLine programm has some pretty nice parameters such aus -pef (encrypt) and -pdf (decrypt).

so you may encrypt your complete (or just a port of) xxx.config file while it stays useable for your application.

share|improve this answer
add comment

I think for your usual three-tier web application, the secrecy of your database username and password is not something that you care about too much, because you can control network security. Look at MongoDB for example, where passwords are optional and not supported by all configurations. You need to set your database server to only accept connections from your own application servers anyway.

You have multiple accounts (with associated permissions) mostly to protect yourself from accidents, not to really keep separate people apart from each other.

There is no way end users can connect to the database directly.

So keeping the connection credential in an unencrypted property file on the server is fine. If someone gets to the server, you are already in trouble anyway.

Better keep this file outside of the source repository, though.

share|improve this answer
add comment

I do this by encrypting the connection string .
This can be achieved by creating a separate application to encrypt the connection string. And using the decrypting code that is embedded in the application itself.

share|improve this answer
add comment

Your Answer


