Encrypt the password string in web.config

Question

How can I encrypt the password string in web.config?

<system.net>
    <mailSettings>
      <smtp deliveryMethod="Network">
        <network host="smtp.gmail.com" userName="[email protected]" password="test" port="587" />
      </smtp>
    </mailSettings>
</system.net>

What is the correct way to do it?

Answer 1

You are best off encrypting that whole section of the file, as there is tooling built in for this, and it is automatically decrypted when the config file is read (so there's no need to change your code). This is described fully on MSDN, and uses the aspnet_regiis.exe tool.

Answer 2

Check this Scott gu blog : Encrypting Web.Config Values in ASP.NET 2.0

Encrypting Custom Configuration Sections

<configSections>
   <section 
      name="sampleSection" 
      type="System.Configuration.SingleTagSectionHandler" 
   />
</configSections>

<MySecrets
   FavoriteMusic="Disco" 
   FavoriteLanguage="COBOL" 
   DreamJob="Dancing in the opening ceremonies of the Olympics" 
/>

Encrypt MySecrets

aspnet_regiis -pef MySecrets