How to Encrypt and Decrypt Connection Strings in .Net app.config and web.config Files

Encrypting the connection information will make it unreadable. This adds some security to your deployment, as it can stop people from getting valuable credential information. It remains unreadable until someone decrypts it, but measures can be implemented to make this very difficult unless a user has certain permissions on a folder.

Get Microsoft Office including Access:

Got a YouTube Channel? I use TubeBuddy, it is awesome. Give it a try:


For developers looking for a new role, check out:

Want my team to do a project for you? Let's get to it!

Need help on an ETL Project? Contact me today!

#dataengineering #encryptconnectionstring

[prakashkhedkar]

Really great knowledge sharing . Thank you Sir

[TheNitrome]

Just to say, this is a great video buddy well done, it really helped me a lot!

[MuhammadAhmed-pdzu]

Yea man! You are awesome... Looking forward to learning more from you.

[TubeDude]

This was really helpful for me! Thanks so much.

[cumdomino]

Thank you,
Thank you,
Thank you

[CalorieCountingCentral]

Thank you for this! It is very helpful.

[TubeDude]

I have a curious question about this that I haven't been able to find addressed anywhere, maybe you can provide some insight:
My understanding of this encryption mechanism is that it uses encryption keys that are part of the physical hardware of the computer. This is why transferring the exe and config file to a different computer will not help. But what about Virtual Machines? I have just deployed an app that uses this method on a program running on an Amazon EC2 instance. I encrypted the config file once and then every time my program runs, it automatically decrypts it. EC2 instances boot up on different hardware every time they run. In addition, I've created an Amazon Image of my EC2 instance so that I can have many more running instances of this image, all of which will run on different hardware. Yet the decryption of the config file that I encrypted on the original machine still works on all the various instances! If the encryption is based on the specific hardware of the machine where it was encrypted, this shouldn't be possible.
So what is going on here?

[DH-rtwl]

What should you do if you need multiple clients on different machines to use one (centrally managed) encrypted connection string?

[datadecoder_sai]

I have a web-application hosted on Azure cloud. Can I encrypt and decrypt it in my webconfig file itself

[omarsebakhi]

But how to take benefit of this way for desktop or mobile applications since the encrypted connection string cannot be decrypted on any other computers?

[กิตติอัคควัฒนกุล]

i use dotnetpeek to detect to detect your method decrypt code so how would we handle this because i copy your decrypt method and then got your db connection again

[mrplatypus]

Sean, great video. Please would you provide a video using

[AlThePal]

Is this the same way you would do it in MVC 6 .NET 6 or is there a new way to do it?

[joker-qo]

sir this was helpful, i tried to encrypt .config file and works fine, now i tring to use DnSpy i put windowsApplication.exe into Dnspy and return me the actual connection string ? how this is possible ???

[godofdestructiondhanasekha]

How to decrypt an encrypted file like json? Obb of Android application

[Jeshhafterhours]

it does not run when the code is deployed to the server.. works only in the local machine

[KhalidAfridi]

Great! but I'm worried about the code if someone run on his/her computer, they can easily decrypt the connection strings in app.config file. My deployed application is on network drive and I'm using DbConnection Class instead of Configuration Manager. (for safety reasons)

[jeremykings]

I have a question, can anyone decrypt the connection string that was encrypted?

[edgewrld]

lol we just got hacked our config is not encrypted haha thanks let me try this sir