title: Encrypt passwords stored in environment variables
body: <p>I have a NodeJS app which accesses several databases. At the moment I've used <a href="https://github.com/motdotla/dotenv" rel="nofollow noreferrer">dotenv</a> to store the database passwords in environment variables to avoid saving them in source code (and avoid committing them to the repo).</p>
  <p>However, this still stores the passwords in plain text in the <code>.env</code> file, which sits on the server in the app root. If the server was ever compromised the passwords would be there for someone to use to connect directly to the databases.</p>
  <p>Is the way to solve this problem, by somehow encrypting the passwords, saving the encrypted string in the environment variables, and have the server (Node) decrypt them before they're used in the connection strings..?</p>
  <p>I believe that when something is encrypted, it can always be decrypted. However, doing this avoids storing the passwords in plain text, so they couldn't be used as-is to connect to the database.</p>
  <p>Recommendations for <code>npm</code> modules would be great. I've found <a href="https://github.com/brix/crypto-js" rel="nofollow noreferrer">crypto-js</a> and <a href="https://github.com/digitalbazaar/forge" rel="nofollow noreferrer">forge</a>, but I don't know what I should be using.</p>
  <p>Is this a professional solution..?  What type of encryption should I be using..?</p>