title: What is the difference between signed and encrypted cookies in Rails?
body: <p>The documentation of <code>ActionDispatch::Cookies</code> gives nearly identical descriptions for both signed cookies and encrypted cookies. It appears that both use <code>secrets.secret_key_base</code> to prevent client-side tampering. <a href="http://api.rubyonrails.org/classes/ActionDispatch/Cookies.html" rel="noreferrer">http://api.rubyonrails.org/classes/ActionDispatch/Cookies.html</a></p>
  
  <h2>Signed Cookies</h2>
  
  <blockquote>
    <p>Sets a signed cookie, which prevents users from tampering with its value.
    The cookie is signed by your app's <code>secrets.secret_key_base</code> value.
    It can be read using the signed method <code>cookies.signed[:name]</code></p>
  </blockquote>
  
  <pre><code>cookies.signed[:user_id] = current_user.id
  </code></pre>
  
  <h2>Encrypted cookies</h2>
  
  <blockquote>
    <p>Sets an encrypted cookie value before sending it to the client which
    prevent users from reading and tampering with its value.
    The cookie is signed by your app's <code>secrets.secret_key_base</code> value.
    It can be read using the encrypted method <code>cookies.encrypted[:name]</code></p>
  </blockquote>
  
  <pre><code>cookies.encrypted[:discount] = 45
  </code></pre>
  
  <hr>
  
  <p>My question is: What is the difference between the two?</p>
  
  <p>When would you want to use one over the other?</p>