How to store and retrieve database connection password encrypted using C#

Question

I have searched for an encryption method for storing and retrieving database username and password in web.config, but most of the posts are discussing only about creating a function to encrypt text but not storing as well as retrieving it.

Is there an inbuilt function to encrypt text in C# using a password phrase? I could not find any.

Now I use function given in one of the SO posts for encryption and decryption, but I see some special characters in the encrypted text. If I want to store the encrypted text in web.config the value should be html compliant.

I would be interested in any other approach for both storing and retrieval scenarios.

you dont want to save any username/password to the web.config. Why would you want that? — Jonesopolis
– Jonesopolis, Commented Aug 18, 2013 at 7:12
i store connection string in web.config to connect to the database. instead of storing the db pwd in connection string as plain text i want to store it encrypted — sjd
– sjd, Commented Aug 18, 2013 at 10:26
If you are wanting to protect your credentials from being stolen by a hacker, but your web app can decode them, then a hacker could just decode them herself using your decryption code and decryption password. I am not sure whether this is an increase in security. — halfer
– halfer, Commented Aug 21, 2019 at 8:06

alex · Accepted Answer · 2013-08-18 08:56:07Z

1

You can use Data Protection API to encrypt your data. That data could be decrypted only under current windows user account on this computer.

So, if you create a separate account for you web application pool, only web app would be able to encrypt and decrypt that data.

answered Aug 18, 2013 at 8:56

alex

12.7k4 gold badges50 silver badges69 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

sjd Over a year ago

thanks alex. the data protection API is bit complex for my level. i thought its a basic scenario in asp.net development. store a pwd encrypted in web.config and retrieve

Jonesopolis · Accepted Answer · 2013-08-19 02:20:21Z

0

how about the encrypt/decrypt methods in this example

then

string conn = Decrypt(ConfigurationManager.ConnectionStrings[ConnString].ConnectionString);

answered Aug 19, 2013 at 2:20

Jonesopolis

25.4k12 gold badges72 silver badges115 bronze badges

2 Comments

sjd Over a year ago

i do have the encrypt/decrypt functions as in the link. but the output of encrypt has special characters like slash etc..so i was afraid if it would decrypt correctly. and i was wondering if there is any better method

Jonesopolis Over a year ago

have you tested it to see if it successfully decrypts those characters?

Collectives™ on Stack Overflow

How to store and retrieve database connection password encrypted using C#

2 Answers 2

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related