title: What is the best way to store an AES encryption key?
body: <p>We use Tomcat for our java web application. There is a properties file under WEB-INF folder. </p>
  
  <p>AES encryption will be used to generate key and encrypt password. The encrypted password will be stored in the properties file. Where should be the encryption key stored? Is it a good idea to put the key and the encrypted password in the same properties file? Or should the key be stored outside of the 'webapps' directory? </p>