Click here to Skip to main content
Click here to Skip to main content

Encrypt and Decrypt ConnectionString in app.config and/or web.config!

, 8 Sep 2007 CPOL
Rate this:
Please Sign up or sign in to vote.
Encrypt and Decrypt ConnectionString in app.config and/or web.config!


In Windows/Web based applications, it's not rational for you to put your ConnectionString in the native/normal format! This is because anybody can see your userID/username and password!.

In this article, I want to teach you how to encrypt ConnectionString and decrypt it as you wish.


This feature was born in .NET Framework 2.0 (Visual Studio 2005).

Using the Code

First of all, we suggest you to create a static class with the name Utilities and put the below functions in it. After all, you can call just two functions for encryption and decryption of your connection string.

namespace DT.Security
    public static class Utilities
        public static void ProtectConnectionString()
		(System.Windows.Forms.Application.ExecutablePath, true);

        public static void UnprotectConnectionString()
		(System.Windows.Forms.Application.ExecutablePath, false);

        private static void ToggleConnectionStringProtection
				(string pathName, bool protect)
            // Define the Dpapi provider name.
            string strProvider = "DataProtectionConfigurationProvider";
            // string strProvider = "RSAProtectedConfigurationProvider";

            System.Configuration.Configuration oConfiguration = null;
            System.Configuration.ConnectionStringsSection oSection = null;

                // Open the configuration file and retrieve 
	       // the connectionStrings section.

                // For Web!
                // oConfiguration = System.Web.Configuration.
	       //                  WebConfigurationManager.OpenWebConfiguration("~");

                // For Windows!
                // Takes the executable file name without the config extension.
                oConfiguration = System.Configuration.ConfigurationManager.

                if (oConfiguration != null)
                    bool blnChanged = false;

                    oSection = oConfiguration.GetSection("connectionStrings") as

                    if (oSection != null)
                        if ((!(oSection.ElementInformation.IsLocked)) &&
                            if (protect)
                                if (!(oSection.SectionInformation.IsProtected))
                                    blnChanged = true;

                                    // Encrypt the section.
                                if (oSection.SectionInformation.IsProtected)
                                    blnChanged = true;

                                    // Remove encryption.

                        if (blnChanged)
                            // Indicates whether the associated configuration section 
                            // will be saved even if it has not been modified.
                            oSection.SectionInformation.ForceSave = true;

                            // Save the current configuration.
            catch (System.Exception ex)
                throw (ex);

Points of Interest

After I learned this feature, I used it in all of my Windows/Web based applications!


  • 8th September, 2007: First release


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Dariush Tasdighi
Web Developer Sematec Ins.
Iran (Islamic Republic Of) Iran (Islamic Republic Of)
My experiences are:
HTML 5.0, CSS 3.0
JQuery, Angular JS, Bootstrap
MVC 5.0, WEB API, c#
My Site URLs:
My Yahoo Group URL:
Mobile: 0098-912-108-7461
Address: Tehran, Tehran, Iran

Comments and Discussions

QuestionNot working. Pinmembersunayv20-Jun-13 1:41 
Questionخیلی استادی. استاد Pinmemberhamed elahi16-Mar-13 2:58 
سلام. از اینکه می بینم استادم اینقدر متواضعانه تجربیاتش رو اینقدر دقیق و بسور رایگان روی این سایت میگذاره بخ خودم افتخار می کنم که شاگرد همچین استادی بودم. Wink | ;) Wink | ;)
خیلی حال کردم وقتی اسم شما رو به عنوان مولف این پروژه دیدم هرچند برای شما خیلی ساده و کوچیکه اما برای من بسیار لذت بخش بود
QuestionTwo different computer can't read the same encrypted file Pinmemberbiczek26-Jan-13 7:02 
AnswerRe: Two different computer can't read the same encrypted file Pinmembersergiomf20-Aug-14 6:14 
GeneralMy vote of 5 Pinmembermanoj kumar choubey30-Mar-12 0:28 
Questiondidn't work for me, full of bugs. PinmemberMember 238286828-Jun-11 17:52 
GeneralMy vote of 5 PinmemberVirtualIdeal7-Dec-10 17:21 
GeneralMy vote of 5 PinmemberReyhaneh22-Sep-10 9:35 
QuestionWhat's the difference? PinmemberGreizzerland18-Jan-10 8:19 
GeneralSeems unsecure Pinmemberxr280xr2-Mar-09 7:14 
GeneralRe: Seems unsecure PinmemberCStroliaDavis24-Jun-09 12:34 
QuestionCan not be declassified Pinmemberlvxiaojiang26-Jun-08 18:54 
QuestionHow can I apply it on Window service Pinmemberbmwgamil18-Oct-07 12:16 
NewsTwo other related encryption articles in CodeProject ... PinmemberTony Selke27-Sep-07 8:05 
GeneralVeiled Attempt at Social Engineering PinmemberDumpsterJuice9-Sep-07 5:30 
GeneralRe: Veiled Attempt at Social Engineering PinmemberDariush Tasdighi9-Sep-07 23:03 
GeneralRe: Veiled Attempt at Social Engineering PinmemberDumpsterJuice10-Sep-07 2:04 
GeneralTopic already covered PinmemberVasudevan Deepak Kumar9-Sep-07 3:47 
GeneralRe: Topic already covered PinmemberDariush Tasdighi9-Sep-07 4:40 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.141220.1 | Last Updated 8 Sep 2007
Article Copyright 2007 by Dariush Tasdighi
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid