# Encrypt Passwords

Micro Focus recommends that you encrypt all passwords that you enter into a configuration file.

NOTE: The AES encryption method has been hardened in version 12.9.0 and later. Micro Focus strongly recommends that you reencrypt all passwords in configuration files by using the updated tool.

The older AES encryption format and basic encryption methods are now deprecated. Passwords that you have encrypted with older versions continue to work, but ODBC Connector logs a warning. Support for these older encryption methods will be removed in future.

## Create a Key File

A key file is required to use AES encryption.

To create a new key file

1. Open a command-line window and change directory to the ODBC Connector installation folder.

2. At the command line, type:

       autpassword -x -tAES -oKeyFile=./MyKeyFile.ky

   A new key file is created with the name `MyKeyFile.ky`

CAUTION: To keep your passwords secure, you must protect the key file. Set the permissions on the key file so that only authorized users and processes can read it. ODBC Connector must be able to read the key file to decrypt passwords, so do not move or rename it.

## Encrypt a Password

The following procedure describes how to encrypt a password.

To encrypt a password

1. Open a command-line window and change directory to the ODBC Connector installation folder.

2. At the command line, type:

       autpassword -e -tEncryptionType [-oKeyFile] [-cFILE -sSECTION -pPARAMETER] PasswordString

   where:

   Option | Description
   --- | ---
   `-tEncryptionType` | The type of encryption to use: `AES` - AES256 `Basic` DEPRECATED: The basic encryption type is deprecated in version 12.9.0 and later. Use the more secure AES encryption instead. Passwords that you have encrypted with older versions continue to work, but ODBC Connector logs a warning. Support for this older encryption method will be removed in future. For example: `-tAES`
   `-oKeyFile` | AES encryption requires a key file. This option specifies the path and file name of a key file. The key file must contain 64 hexadecimal characters. For example: `-oKeyFile=./key.ky` NOTE: The full (absolute) path of the key file is included in the encrypted value, because ODBC Connector requires the key to decrypt the password. If you move or rename the key file, this path becomes invalid and you must update the encrypted value.
   `-cFILE -sSECTION -pPARAMETER` | (Optional) You can use these options to write the password directly into a configuration file. You must specify all three options. `-c`. The configuration file in which to write the encrypted password. `-s`. The name of the section in the configuration file in which to write the password. `-p`. The name of the parameter in which to write the encrypted password. For example: `-c./Config.cfg -sMyTask -pPassword`
   `PasswordString` | The password to encrypt.

   For example:

       autpassword -e -tBASIC MyPassword

       autpassword -e -tAES -oKeyFile=./key.ky MyPassword

       autpassword -e -tAES -oKeyFile=./key.ky -c./Config.cfg -sDefault -pPassword MyPassword

   The password is returned, or written to the configuration file.

## Decrypt a Password

The following procedure describes how to decrypt a password.

To decrypt a password

1. Open a command-line window and change directory to the ODBC Connector installation folder.

2. At the command line, type:

       autpassword -d -tEncryptionType PasswordString

   where:

   Option | Description
   --- | ---
   `-tEncryptionType` | The type of encryption: `Basic` `AES` - AES256 For example: `-tAES`
   `PasswordString` | The password to decrypt.

   For example:

       autpassword -d -tBASIC 9t3M3t7awt/J8A

       autpassword -d -tAES PasswordString

   The password is returned in plain text.

_FT_HTML5_bannerTitle.htm