Title: How to Encrypt and Decrypt only password in connectionStrings Web.config/App.config in C#?
Tags: c#;encryption;configuration;cryptography
Question: I have an console application, where I should connect to a SQL Server. It is protected by password.
I have to decrypt only the password value from the <connectionStrings&gt; tag like
<add name="ConnectionStringname"
connectionString="Data Source=xx.x.x.xx;Initial Catalog=DbName;User ID=xxx;Password="DecryptedValueOfPasword" /&gt;
I have tried these approaches, please let me know which one is the best or any other approaches please let me know.
Approach 1 : encrypt and decrypt the whole <connectionStrings&gt; tag using this command
aspnet_regiis -pef connectionStrings "app.config Path"
Approach 2 : encrypt and decrypt the only the password value
Step 1 : Removed password value from the connection strings and password value added in custom tag.
<add name="ConnectionStringname"
connectionString="Data Source=xx.x.x.xx;Initial Catalog=DbName;User ID=xxx;" /&gt;
Step 2 : decrypting the custom tag using the RSA key i.e using the aspnet_regiis.exe command .
Step 3 : in the code-behind file, read the decrypted password value and  append the password value in connection string
<add name="ConnectionStringname"
connectionString="Data Source=xx.x.x.xx;Initial Catalog=DbName;User ID=xxx;Password="EncryptedValueOfPasword" /&gt;
Approach 3 : create class library
public class EncryptDecryptClass {
public string Encrypt(string plainText)
{
if (plainText == null)
throw new ArgumentNullException("plainText");
//encrypt data
var data = Encoding.Unicode.GetBytes(plainText);
byte[] encrypted = ProtectedData.Protect(data, null, Scope);
//return as base64 string
return Convert.ToBase64String(encrypted);
}
public string Decrypt(string cipher)
{
if (cipher == null)
throw new ArgumentNullException("cipher");
//parse base64 string
byte[] data = Convert.FromBase64String(cipher);
//decrypt data
byte[] decrypted = ProtectedData.Unprotect(data, null, Scope);
return Encoding.Unicode.GetString(decrypted);
}


Here is another answer: Use XML instead of config file.store your credentials in XML file and encrypt password in XML file and get from there
<?xml version="1.0" encoding="utf-8" ?&gt;
<Connections&gt;
<UserId&gt;sa</UserId&gt;
<Password&gt;DecryptedValueOfPasword</Password&gt;
</Connectionstring&gt;
Something like above

Here is another answer: First of all I don't understand why do you have to decrypt only the password value? Other parts of connection string represent security information like db name, or user id. So you have to encrypt whole connection string, not only a part of it.
Approach 1 is the best option as it has the following benefits:
You don't need to write any custom code for encryption/decryption.
You don't need to modify your code, as .net framework will decrypt connection string automatically.
An administrator will be able to decrypt the connection string from the server box by running aspnet_regiis -pd "connectionStrings"
You can import/export RSA key container between servers if you have a servers farm
Comment for this answer: Thanks for your answer.
I wants to only decrypt the Password value.
Using the 1st approach if i want to decrypt the connectionStrings tag in app.config rename the app.config to web.config after that execute the command and again rename the web.config to app.config.

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 2, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2015:00:10/27/15', 'FavoriteCount': 1.0, 'PostTypeId': 1, 'Tags': '<c#><encryption><configuration><cryptography>', 'Title': 'How to Encrypt and Decrypt only password in connectionStrings Web.config/App.config in C#?', 'ViewCount': 4173, 'id': 33361292, 'user_AboutMe': None, 'user_AccountId': 2825606.0, 'user_DisplayName': 'user17276', 'user_Reputation': 61.0, 'user_Views': 7.0, 'user_id': 4572459.0}}