# Recommended method for encrypting passwords before storing them in a database **URL:** \ **Category:** Ignition\ **Tags:** perspective\ **Created:** [August 25, 2025, 6:30pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158 "2025-08-25T18:30:29Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Noah\_Gilgo](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@Noah\_Gilgo](https://forum.inductiveautomation.com/u/Noah_Gilgo)\ **Post date:** [August 25, 2025, 6:30pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/1 "2025-08-25T18:30:29Z")
Are there recommended encryption algorithms/libraries for encrypting password data gathered in Ignition before storing it in a database? Jython is missing a lot of newer Python encryption libraries such as Argon2id and bcrypt, so I was wondering if there are any common community solutions/standards that are typically implemented when trying to encrypt and store sensitive data such as system credentials, API passwords, etc. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 25, 2025, 6:33pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/2 "2025-08-25T18:33:04Z")
Do you need to store for later retrieval and conversion back to plaintext, or do you need to store a _hash_ of the password, which is what Argon2 and bcrypt are for? ---
**Author:** ![Noah\_Gilgo](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@Noah\_Gilgo](https://forum.inductiveautomation.com/u/Noah_Gilgo)\ **Post date:** [August 25, 2025, 6:48pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/3 "2025-08-25T18:48:18Z")
I’m looking to store system credentials such as API passwords, so I presume I’d need a secure method of 2-way encryption such as with AES-256. I apologize for the mistake, I now realize that hashing is probably not the solution I’m looking for. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [August 25, 2025, 6:49pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/4 "2025-08-25T18:49:39Z")
> [@Noah\_Gilgo](#): > > I’m very new to cybersecurity. > [@Noah\_Gilgo](#): > > I’m looking to store system credentials 😨 I would recommend waiting for a future 8.3 release where we allow you to offload credential storage to a third party vault and access it from scripting. ---
**Author:** ![Noah\_Gilgo](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@Noah\_Gilgo](https://forum.inductiveautomation.com/u/Noah_Gilgo)\ **Post date:** [August 25, 2025, 6:57pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/5 "2025-08-25T18:57:07Z")
That sounds very convenient and useful for my current predicament, and I don’t doubt that that’s a solution I would likely implement if it was currently available, but are there any present working solutions to this kind of problem in lieu of future updates that could make them obsolete? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [August 25, 2025, 7:00pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/6 "2025-08-25T19:00:14Z")
In general, your answer in Ignition should not be "try to find a Python lib that does X" but "try to find a **Java** lib that does X". For which there are a variety of Java encryption libs available, and some would be available to you implicitly on the classpath because we use them internally. Be aware that, basically by definition within the scripting environment the best you can do is **obfuscate** secrets. You cannot store a key somewhere to access that cannot also be read/exploited by someone else with malicious access. ---
**Author:** ![Noah\_Gilgo](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@Noah\_Gilgo](https://forum.inductiveautomation.com/u/Noah_Gilgo)\ **Post date:** [August 25, 2025, 7:07pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/7 "2025-08-25T19:07:40Z")
Okay, thank you for all of your help! ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [August 25, 2025, 9:49pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/8 "2025-08-25T21:49:54Z")
I'll be working on a similar problem in the next few weeks. One of my ideas was to store half of the master password key in the project and the other half in a system file. The idea being that the full key couldn't be extracted from a gateway backup file. Is there a grand fallacy in this approach? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 25, 2025, 10:01pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/9 "2025-08-25T22:01:19Z")
You'd need to store the half that wasn't part of the gwbk somewhere else in case you lose the server. But why bother at all with putting half in the project? Why not just put the whole secret on the file system? ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [August 25, 2025, 10:04pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/10 "2025-08-25T22:04:08Z")
> [@Kevin.Herron](#): > > Why not just put the whole secret on the file system? I haven't got a good answer to that question! 🤪 ---
**Author:** ![Adriano\_Generoso\_da](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adriano_generoso_da/32/43895_2.png) [@Adriano\_Generoso\_da](https://forum.inductiveautomation.com/u/Adriano_Generoso_da)\ **Post date:** [September 1, 2025, 12:14pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/11 "2025-09-01T12:14:42Z")
I have one example using SHA256 using Java Libraries, so we have the Secret and Salt to encrypt and decrypt > from javax.crypto import Cipher > from javax.crypto import SecretKey > from javax.crypto import SecretKeyFactory > from javax.crypto.spec import IvParameterSpec > from javax.crypto.spec import PBEKeySpec > from javax.crypto.spec import SecretKeySpec > from java.nio.charset import StandardCharsets > from java.security.spec import KeySpec > from java.util import Base64 > > import java.lang.Exception > logger = system.util.getLogger('encryptionLogger') > > #SECRET\_KEY = 'one\_key\_to\_rule\_them\_all' > #SALT = 'salt\_of\_the\_earth' > > def encrypt(strToEncrypt, SECRET\_KEY, SALT): > encryptedText = '' > try: > iv = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] > ivspec = IvParameterSpec(iv) > > ```python > factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256") > spec = PBEKeySpec(list(SECRET_KEY), SALT.encode("UTF-8"), 65536, 256) > tmp = factory.generateSecret(spec) > secretKey = SecretKeySpec(tmp.getEncoded(), "AES") > cipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); > cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivspec); > cipherText = cipher.doFinal(strToEncrypt.encode("UTF-8")) > encoder = Base64.getEncoder() > encryptedText = encoder.encodeToString(cipherText) > > except Exception, e: > logger.warnf("Encrypt Exception: %s",e) > > return encryptedText > > ``` > > def decrypt(encryptedText, SECRET\_KEY, SALT): > decryptedText = '' > > ```python > try: > iv = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] > ivspec = IvParameterSpec(iv) > > factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256") > spec = PBEKeySpec(list(SECRET_KEY), SALT.encode("UTF-8"), 65536, 256) > tmp = factory.generateSecret(spec) > secretKey = SecretKeySpec(tmp.getEncoded(), "AES") > cipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); > cipher.init(Cipher.DECRYPT_MODE,secretKey,ivspec) > decoder = Base64.getDecoder() > cipherText = decoder.decode(encryptedText.encode('UTF-8')) > decryptedText = ''.join(map(chr,cipher.doFinal(cipherText))) > except Exception, e: > logger.warnf('Decrypt Exception: %s',e) > > return decryptedText > > ``` Thanks for the posts: [AES Encryption using Scripting - Ignition - Inductive Automation Forum](https://forum.inductiveautomation.com/t/aes-encryption-using-scripting/24554/3) [AES 256 Encryption Using Scripting? - Ignition - Inductive Automation Forum](https://forum.inductiveautomation.com/t/aes-256-encryption-using-scripting/53324/3) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [September 1, 2025, 1:58pm UTC](https://forum.inductiveautomation.com/t/recommended-method-for-encrypting-passwords-before-storing-them-in-a-database/110158/12 "2025-09-01T13:58:23Z")
Your error handling is broken. `except Exception, e:` with only catch jython errors, not any java errors. You should use `from java.lang import Throwable` to make that name available, then include another clause to catch it. (You need two except clauses to reliably catch both java and jython exceptions--they do not share a parent class.)