I am looking for a secure (and as easy as possible) way to store my encryption key.

I have been looking at some services that will hold the key for you and then you can retrieve it with an api. The idea is that they store it safely and on another environment, making it harder to get the key than for example from a .env file.

But, what I don’t understand is how is this more secure? I mean, the key is stored safetely on another environment, but to get the key I have to use certificates to authenticate myself, and these are stored in my environment.

So basically, would it not be as easy for a hacker to get hold of the certificate and use those to get the key, as it is to get the key directly?

For more information from one of the services (lockr.io), you can scroll down to client certificates: https://docs.lockr.io/#lockr-general-concepts

1 Answer 1


If you are talking about storing a single static encryption key, there is little value in setting up a vaulting service to store the key for you versus using an environment variable.

Where vaulting services shine is managing dynamic keys (e.g. generating a new encryption key for each session), sharing keys across different users, performing cryptographic operations (e.g. encrypt/decrypt on behalf of the service), performing AAA of usage of keys and access management to keys.

One thing to note, is that you normally do not store .env files for production systems, rather you load the environment variables dynamically so that they are only stored in memory. Env files should only be used if you are using it to test on your local machine.

  • Just out of curiosity, how do you "load the environment variables dynamically" without using the Vault service?
    – pri
    Apr 18, 2022 at 7:12
  • With ”load the environment variables dynamically”, do you mean setting the variables directly in the environment itself if it has fields for this (like for heroku)? If so, you do not always have that if you are using a standard vps somewhere for example. I guess you then have to use a .env file instead? Also.. if vault is not giving you extra security, then what should you do instead to secure the key? Apr 18, 2022 at 7:35
  • @pri I was assuming OP was indeed running on a cloud based service, of course with a standardized VPS this is not possible (without manual intervention). Apr 18, 2022 at 7:44
  • @Hejhejhej123 you would be stuck with your environment variable file. One thing to then do is to limit the access to that file to just the user under which the application runs. Alternatively, you can also set the environment variable manually rather than storing it. Apr 18, 2022 at 7:45
  • Ok, so there is nothing else I can do to secure it? Only changing my whole vps to a cloud service? Apr 18, 2022 at 8:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .