Storing and Reading Base64 Encoded Connection String in Web.Config


Many people store database connection string in web.config file. However, web.config file being an XML file, the data stored there is in clear text format. This is especially important for connection strings because anybody can easily see your database details including user id and password. In this article we will see how you can encrypt values stored in web.config using Base64 encoding and later on decrypt them in your code. Note that Base64 encoding is not a secure algorithm but it is a quick and easy way to hide the connection string details from casual readers.

Storing custom values in web.config

You store custom configuration values in web.config using <appSettings> section. The section looks like this:

   <add key="connectionstring" 
   value="data source=.\vsdotnet;initial 
   catalog=Northwind;user id=sa;password=mypassword"/>

In short you store key-value pairs inside the <appSettings> section.

Encrypting connection string

In order to encrypt above connection string we will be using System.Convert class. We will build a small console application that allows us to pass plain connection string as command line argument and then displays encrypted version on the console.

The code looks like this:

Public Shared Sub Main(args() As String)
Dim data() As Byte = System.Text.ASCIIEncoding.ASCII.GetBytes(args(0))
Dim str As String = Convert.ToBase64String(data)
End Sub

Here, we are using System.Text.ASCIIEncoding.ASCII class to convert the connection string to an array of bytes. This is necessary because the Convert class function ToBase64String() expects array of bytes and then returns Base64 encoded version of it.

You can invoke above application (I created it as Base64Encrypter.exe) at command prompt like this:

Base64Encrypter.exe  "data source=.\vsdotnet;initial catalog=Northwind;user id=sa;password=mypassword"

The output will be:


You can now copy-paste this encoded version of the connection string in the web.config. The new appSettings section will look like this:

   <add key="connectionstring"

Reading the encrypted connection string back

Now, let us see how we can read the encrypted connection string and decrypt it so that we can use it further.

Dim data() As Byte = Convert.FromBase64String
str = System.Text.ASCIIEncoding.ASCII.GetString(data)

Here, we again used the Convert class and called its FromBase64String function. This function accepts Base64 encoded string and returns a byte array. In order to retrieve the appSetting value we used ConfigurationSettings class as shown above. Finally, we used ASCII class again to convert the byte array to a string.


In this article we saw how to encrypt and decrypt your web.config values using Base64 encoding. Note that Base64 encoding is NOT a secure algorithm but it hides the connection string details from causal readers. You can use some stronger cryptographic algorithm if you wish.



Bipin Joshi is an independent software consultant and trainer by profession specializing in Microsoft web development technologies. Having embraced the Yoga way of life he is also a yoga mentor, meditation teacher, and spiritual guide to his students. He is a prolific author and writes regularly about software development and yoga on his websites. He is programming, meditating, writing, and teaching for over 27 years. To know more about his private online courses on ASP.NET and meditation go here and here.

Posted On : 24 April 2004

Tags : ASP.NET Web Forms Security Configuration