title: How to make safe encryption with Jasypt?
body: <p>On jasypt.org regarding question &quot;<strong>Can I decrypt an encrypted password?</strong>&quot; it says here  <a href="http://www.jasypt.org/faq.html#does-jasypt-implement-algorithms" rel="nofollow noreferrer">http://www.jasypt.org/faq.html#does-jasypt-implement-algorithms</a> :
  &quot;If you have encrypted it using a message digesting technique, which is precisely what you should have done (by using a PasswordEncryptor implementation, StandardStringDigester or similar...), <strong>you cannot</strong>.&quot;</p>
  <p>I must say I've tried in various ways, but it seems to me I always have same problem.
  I am not aware why Jasypt makes it possible for everyone to decrypt to original value. For example, I can easly encrypt it but also decrypt it with mvn commands:</p>
  <p>Example for encrypt and decrypt with jasypt:</p>
  <p>encrypt:</p>
  <pre><code>mvn jasypt:encrypt-value -Djasypt.plugin.value=&quot;test&quot; -Djasypt.encryptor.password=&quot;pass&quot; -Djasypt.encryptor.algorithm=&quot;PBEWithMD5AndDES&quot; -Djasypt.encryptor.key-obtention-iterations=1000 -Djasypt.encryptor.pool-size=1 -Djasypt.encryptor.provider-name=&quot;SunJCE&quot; -Djasypt.encryptor.salt-generator-classname=&quot;org.jasypt.salt.RandomSaltGenerator&quot; -Djasypt.encryptor.iv-generator-classname=&quot;org.jasypt.iv.NoIvGenerator&quot; -Djasypt.encryptor.string-output-type=&quot;base64&quot;
  </code></pre>
  <p>As you can see, in first command, I provide value &quot;<strong>test</strong>&quot; and password &quot;<strong>pass</strong>&quot; to be decrypted.
  It generates: ENC(<strong>u7uKa3B9Xfey+zZ46tOmag==</strong>)</p>
  <p>And with that, I can easily execute second command, and I will get original value, which is &quot;test&quot;.</p>
  <p>decrypt:</p>
  <pre><code>mvn jasypt:decrypt-value -Djasypt.plugin.value=&quot;u7uKa3B9Xfey+zZ46tOmag==&quot; -Djasypt.encryptor.password=&quot;pass&quot; -Djasypt.encryptor.algorithm=&quot;PBEWithMD5AndDES&quot; -Djasypt.encryptor.key-obtention-iterations=1000 -Djasypt.encryptor.pool-size=1 -Djasypt.encryptor.provider-name=&quot;SunJCE&quot; -Djasypt.encryptor.salt-generator-classname=&quot;org.jasypt.salt.RandomSaltGenerator&quot; -Djasypt.encryptor.iv-generator-classname=&quot;org.jasypt.iv.NoIvGenerator&quot; -Djasypt.encryptor.string-output-type=&quot;base64&quot;
  </code></pre>
  <p>In my .pom file, I have defined this in dependencies part:</p>
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;com.github.ulisesbocchio&lt;/groupId&gt;
      &lt;artifactId&gt;jasypt-spring-boot&lt;/artifactId&gt;
      &lt;version&gt;3.0.2&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p>and also this in build part (so I can execute jasypt through maven):</p>
  <pre><code>&lt;plugins&gt;
      &lt;plugin&gt;
        &lt;groupId&gt;com.github.ulisesbocchio&lt;/groupId&gt;
        &lt;artifactId&gt;jasypt-maven-plugin&lt;/artifactId&gt;
        &lt;version&gt;3.0.2&lt;/version&gt;
      &lt;/plugin&gt;
  &lt;plugins&gt;
  </code></pre>
  <p>My application yml looks like this:</p>
  <pre><code>jasypt:
      encryptor:
          password: pass
          algorithm: PBEWithMD5AndDES
          key-obtention-iterations: 1000
          pool-size: 1
          provider-name: SunJCE
          salt-generator-className: org.jasypt.salt.RandomSaltGenerator
          iv-generator-className: org.jasypt.iv.NoIvGenerator
          string-output-type: base64
          
  spring:
    datasource:
      database-name: *****
      jdbc-url: *****
      username: *****
      password: ENC(u7uKa3B9Xfey+zZ46tOmag==)
  </code></pre>
  <p>And everything works fine (I've tried it also with bean through java code, it is totally same, just different style). But why should I do that and leave it like that, knowing that a hacker can, just like me, execute this command and get actual value:</p>
  <p>He can do this, and he has everything he needs - he can read both &quot;<strong>u7uKa3B9Xfey+zZ46tOmag==</strong>&quot; and &quot;<strong>pass</strong>&quot; from my code:
  decrypt:</p>
  <pre><code>mvn jasypt:decrypt-value -Djasypt.plugin.value=&quot;u7uKa3B9Xfey+zZ46tOmag==&quot; -Djasypt.encryptor.password=&quot;pass&quot; -Djasypt.encryptor.algorithm=&quot;PBEWithMD5AndDES&quot; -Djasypt.encryptor.key-obtention-iterations=1000 -Djasypt.encryptor.pool-size=1 -Djasypt.encryptor.provider-name=&quot;SunJCE&quot; -Djasypt.encryptor.salt-generator-classname=&quot;org.jasypt.salt.RandomSaltGenerator&quot; -Djasypt.encryptor.iv-generator-classname=&quot;org.jasypt.iv.NoIvGenerator&quot; -Djasypt.encryptor.string-output-type=&quot;base64&quot;
  </code></pre>
  <p>He just needs to read this ENC(<strong>u7uKa3B9Xfey+zZ46tOmag==</strong>) (which he can, from yml file, and &quot;<strong>pass</strong>&quot; also from yml file (he can do this also). And there it is, he can get original value back. I don't see any security in this. Hacker only needs to know how to execute mvn decrypt command (I've managed to do it here in this example, why someone wouldn't manage to do it also), and it's basically same as encrypt.</p>
  <p>Someone might argue, 'well, you can pass your password (&quot;pass&quot;) through environment variable'. Doesn't work for me. Because both files for Gitlab and Dockerfile, I have both in project, and if I set those variables there, still hacker can read it and it get actual value in a matter of seconds. They are bind to my project. Also, providing actual passwords like environmental variables on systems like Gitlab or Kubernetes seems very risky to me. Hacker, if he is very advanced, can read those values also. So why expose them. And seems that is only solution from Jasypt, to set variables like APP_ENCRYPTION_PASSWORD.</p>
  <p><strong>My question is can you somehow disable Jasypt decrypt, in order not to get actual value back, so hacker can't also get to it? That seems to be safest option to me. Or some similar solution to solve my problem? Provide an example if you can, please.</strong>  It would be good that Jasypt can somehow generate password on the fly, just like it generates salt, but how. I know, then person should dynamically populate yml file and that is not possible. I really can't see how is this with Jasypt secure if I only need password and encrypted value to decrypt original value back. Both those hacker can read in source code and that seems very bad security in my opinion. And then, what is the purpose of masking database passoword in yml file. If everything can be unpacked in matter of seconds. This seem very weak security to me. Please inform me how can I make it more secure than the way it is now.</p>