Practical ASP.NET

Encrypting the Web.Config File

If you're concerned about keeping critical information in your Web.config file, then you should encrypt it -- or at least the parts that you're concerned about.

I love keeping information in my Web.config file's appSettings section; it lets me change the behavior of a Web site just by changing values in a text file. I especially like keeping connection strings in the connectionStrings element (it lets me ensure that I keep the number of connection strings to a minimum, which enhances connection pooling performance).

My clients don't always agree with me about storing data in the config file. To be more specific, my clients are concerned about keeping sensitive information (like connectionStrings) in a text file. I tell my clients that if people can pull text files off their Web server, then they have problems that even I can't solve.

My clients don't find that a compelling argument.

And, to be honest, they have a point. A sizeable percentage of security breaches are made by people inside an organization -- people the Web site may not protect itself from. So I suggest to my clients encrypt their web.config file. I skimmed over this topic in an earlier column on managing the Web.config file during deployment ("Managing Web.Config Settings During Deployment"). After a couple of reader questions, I'm finally getting around to discussing the topic in detail.

Encrypting Sections
This is the code that I use to encrypt a specific section of the Web.config file. I first select a section using the Configuration object's Sections collection. In this case, I'm selecting the connectionStrings section:

Dim configFile As System.Configuration.Configuration 
Dim configSection As ConfigurationSection 

configFile = System.Web.Configuration.WebConfigurationManager. _
configSection = configFile.Sections("connectionStrings")

This code assumes that it's running from a page on the site so I can use the ApplicationPath property on the Request object to get the physical path to the web.config's folder. If you wanted to create a utility, you'd need to hard code the path you pass to the OpenWebConfiguration method.

Now that I have the section, I encrypt it, specifying the encryption scheme that I want to use. The last step is to save the encrypted version back to the config file:


The result looks like this in the Web.config file:

            <CipherValue>...encrypted data... </CipherValue>

The good news is that when you use the ConfigurationManager's ConnectionString collection to retrieve an encrypted connection string, the connection string is automatically decrypted for you. This code works whether the connectionStrings section is encrypted or not:

Dim cnStr As String
cnStr = System.Web.Configuration.WebConfigurationManager. _

Since the strings are encrypted using the private key for the Web server, even if the file is stolen from the site, it can't be decrypted on any machine except the Web server. This also means that you can't encrypt the connection string until the application has been moved to the production server: If you encrypt the connection string on the test server and then move your site to the production server, ASP.NET won't be able to decrypt the string using the production server's private key.

On occasion, you'll need to decrypt the web.config section just to check what's actually in the file. This code takes care of that job:

Dim configFile As System.Configuration.Configuration 
Dim configSection As ConfigurationSection 
configFile = System.Web.Configuration.WebConfigurationManager. _
configSection = configFile.Sections("connectionStrings")

Command Line Encryption
If you'd prefer not to use code, you encrypt (or decrypt) sections of your web.config file using the aspnet_regiis utility. You must pass the utility the -pe parameter to specify the section to encrypt along with the path name to the config file's folder, and you must also pass the -prov parameter to specify the encryption scheme:

aspnet_regiis.exe -pef section physical_directory -prov provider

This example encrypts the configurationStrings section for a config file in the c:\NorthwindCRM folder:

aspnet_regiis.exe -pef configurationStrings c:\NorthwindCRM 
      -prov "RsaProtectedConfigurationProvider" 

You can also use aspnet_regiis utility to decrypt the section using the -pdf parameter instead of -pef.

Or you could just make sure that no one can steal text files from your Web server.

About the Author

Peter Vogel is a system architect and principal in PH&V Information Services. PH&V provides full-stack consulting from UX design through object modeling to database design. Peter tweets about his VSM columns with the hashtag #vogelarticles. His blog posts on user experience design can be found at

comments powered by Disqus


  • ML.NET Improves Object Detection

    Microsoft improved the object detection capabilities of its ML.NET machine learning framework for .NET developers, adding the ability to train custom models with Model Builder in Visual Studio.

  • More Improvements for VS Code's New Python Language Server

    Microsoft announced more improvements for the new Python language server for Visual Studio Code, Pylance, specializing in rich type information.

  • Death of the Dev Machine?

    Here's a takeaway from this week's Ignite 2020 event: An advanced Azure cloud portends the death of the traditional, high-powered dev machine packed with computing, memory and storage components.

  • COVID-19 Is Ignite 2020's Elephant in the Room: 'Frankly, It Sucks'

    As in all things of our new reality, there was no escaping the drastic changes in routine caused by the COVID-19 pandemic during Microsoft's big Ignite 2020 developer/IT pro conference, this week shifted to an online-only event after drawing tens of thousands of in-person attendees in years past.

  • Visual Studio 2019 v16.8 Preview Update Adds Codespaces

    To coincide with the Microsoft Ignite 2020 IT pro/developer event, the Visual Studio dev team shipped a new update, Visual Studio 2019 v16.8 Preview 3.1, with the main attraction being support for cloud-hosted Codespaces, now in a limited beta.

Upcoming Events