<p>I am developing a web app which requires a username and password to be stored in the web.Config, it also refers to some URLs which will be requested by the web app itself and never the client.</p>

<p>I know the .Net framework will not allow a web.config file to be served, however I still think its bad practice to leave this sort of information in plain text.  </p>

<p>Everything I have read so far requires me to use a command line switch or to store values in the registry of the server.  I have access to neither of these as the host is online and I have only FTP and Control Panel (helm) access.</p>

<p>Can anyone recommend any good, free encryption DLL's or methods which I can use?  I'd rather not develop my own!</p>

<p>Thanks for the feedback so far guys but I am not able to issue commands and and not able to edit the registry.  Its going to have to be an encryption util/helper but just wondering which one!</p>

[{'answer_id': 54213, 'author': 'aku', 'author_id': 1196, 'author_profile': 'https://Stackoverflow.com/users/1196', 'pm_score': 5, 'selected': True, 'text': '<ul>\n<li><a href="http://msdn.microsoft.com/en-us/library/zhhddkxy.aspx" rel="noreferrer">Encrypting and Decrypting Configuration Sections</a> (ASP.NET) on MSDN</li>\n<li><a href="http://weblogs.asp.net/scottgu/archive/2006/01/09/434893.aspx" rel="noreferrer">Encrypting Web.Config Values in ASP.NET 2.0</a> on ScottGu\'s <a href="http://weblogs.asp.net/scottgu/default.aspx" rel="noreferrer">blog</a></li>\n<li><a href="http://odetocode.com/Blogs/scott/archive/2006/01/08/2707.aspx" rel="noreferrer">Encrypting Custom Configuration Sections</a> on K. Scott Allen\'s <a href="http://odetocode.com/Blogs/scott/default.aspx" rel="noreferrer">blog</a></li>\n</ul>\n\n<p><strong>EDIT:</strong><br>\nIf you can\'t use asp utility, you can encrypt config file using <a href="http://msdn.microsoft.com/en-us/library/system.configuration.sectioninformation.protectsection.aspx" rel="noreferrer">SectionInformation.ProtectSection</a> method.</p>\n\n<p>Sample on codeproject:</p>\n\n<p><a href="https://secure.codeproject.com/KB/aspnet/webconfig.aspx" rel="noreferrer">Encryption of Connection Strings inside the Web.config in ASP.Net 2.0</a> </p>\n'}, {'answer_id': 54220, 'author': 'Robert S.', 'author_id': 3426, 'author_profile': 'https://Stackoverflow.com/users/3426', 'pm_score': 0, 'selected': False, 'text': '<p>Use aspnet_setreg.exe <a href="http://support.microsoft.com/kb/329290" rel="nofollow noreferrer">http://support.microsoft.com/kb/329290</a></p>\n'}, {'answer_id': 40489084, 'author': 'Matt', 'author_id': 1016343, 'author_profile': 'https://Stackoverflow.com/users/1016343', 'pm_score': 2, 'selected': False, 'text': '<p>While on the first glance it seems to be straightforward, there are a couple of hurdles I encountered.</p>\n\n<p>So I am providing steps that worked fine for me (to encrypt the <strong>appSettings</strong> section) using the default crypto provider:</p>\n\n<p><strong>Encrypt</strong> sections in the web.config:</p>\n\n<ol>\n<li>Open Admin command shell (run <strong>as administrator!</strong>). The command prompt will be on <code>C:</code> which is assumed for the steps below.<br/>Further assumed is that the application is deployed on <code>D:\\Apps\\myApp</code> - replace this by the path you\'re using in <strong>step 3.</strong></li>\n<li><code>cd "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319"</code>, on 32 bit Windows systems use <code>Framework</code> instead of <code>Framework64</code></li>\n<li><code>cd /D "D:\\Apps\\myApp"</code><br/><strong>Note:</strong> The <code>/D</code> switch will change the drive automatically if it is different from your current drive. Here it will change the path and drive, so the current directory will be <code>D:\\Apps\\myApp</code> afterwards.</li>\n<li><code>c:aspnet_regiis -pef appConfig .</code></li>\n</ol>\n\n<p>You should see this message:</p>\n\n<blockquote>\n  <p>Microsoft (R) ASP.NET RegIIS version 4.0.30319.0\n  Administration utility to install and uninstall ASP.NET on the local machine.\n  Copyright (C) Microsoft Corporation.  All rights reserved.\n  Encrypting configuration section...\n  Succeeded!</p>\n</blockquote>\n\n<p>You can also <strong>Decrypt</strong> sections in the web.config:\nThese are the same steps, but with option <code>-pdf</code> instead of <code>-pef</code> for aspnet_regiis.</p>\n\n<p>It is also possible to encrypt other sections of your web.config, for example you can <strong>encrypt the connection strings</strong> section via:</p>\n\n<pre><code>aspnet_regiis -pe "connectionStrings" -app "/SampleApplication"\n</code></pre>\n\n<p>More details about that can be found <a href="https://msdn.microsoft.com/en-us/library/ms178372.aspx" rel="nofollow noreferrer">here.</a></p>\n\n<hr>\n\n<p><strong>Note:</strong> The encryption above is <strong>transparent</strong> to your web application, i.e. your web application doesn\'t recognize that the settings are encrypted. <br/>You can also choose to use <strong>non-transparent</strong> encryption, for example by using Microsoft\'s DPAPI or by using <a href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard" rel="nofollow noreferrer">AES</a> along with the Framework\'s <a href="https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aes?redirectedfrom=MSDN&amp;view=netframework-4.7.2#Anchor_6" rel="nofollow noreferrer">AES Class</a>. <br/>How it is done with <strong>DPAPI</strong> I have described <a href="https://stackoverflow.com/a/15342230/1016343">here at Stackoverflow</a>. DPAPI works very similar in a sense that it uses the machine\'s or user credential\'s keys. Generally, <strong>non-transparent encryption</strong> gives you more control, for instance you can add a SALT, or you can use a key based on a user\'s passphrase. If you want to know more about how to generate a key from a passphrase, look <a href="https://stackoverflow.com/a/45307604/1016343">here</a>. </p>\n'}, {'answer_id': 60998838, 'author': 'Mohamed Eldefrawy', 'author_id': 6627676, 'author_profile': 'https://Stackoverflow.com/users/6627676', 'pm_score': 0, 'selected': False, 'text': '<ol>\n<li>Publish your project</li>\n<li>Open <strong>Developer command Prompt as Administrator</strong></li>\n<li>use this command <strong>asp_rigiis -pef "appSettings" "C:\\yourPublishPath" -prov "DataProtectionConfigurationProvider"</strong></li>\n</ol>\n'}]
['https://Stackoverflow.com/questions/54200', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/2208/']