I have a content as shown below

enter image description here

I have encrypted the content by running the below command

cd C:\Windows\Microsoft.NET\Framework\v4.0.30319 aspnet_regiis.exe -pef "secureAppSettings" "your application web config path" -prov >> "DataProtectionConfigurationProvider"

This generated as follow (Sample , not the real password :) )

enter image description here

But our app settings is going in all devices and accessible to users. How safe is it? they can still copy it. So what is the solution? do I need to encrypt the app setting file itself?

1 Answer 1


Encrypting the complete file or encrypting only the entry will provide the same level of security regarding this entry. There is no practical difference, they offer the same protection against the same threat.

Side note: Please note however that if an end user can reverse-engineer your application or read its memory, this user can discover the encryption key and recover the encrypted password. So, while encrypting can provide some amount of security against common users, it is not enough to resist a motivated attacker with an access to the running application. But maybe those attackers do not exist in your threat model, but then in this case maybe encrypting this entry is pointless and proper access control would be enough. Only you can answer those questions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .