asp.net source code blog

ASP.NET doesn’t serve (display) certain types of files to the browser, including
configuration files. However, don’t tempt fate by flashing a SQL Server
password in the web.config file. Follow these steps to encrypt the connection
strings in the web.config file:

1. Open a command prompt and change to the directory where aspnet_
regiis.exe is stored. (Try C:\WINDOWS\Microsoft.NET\
Framework\v2.0.50727.)

2. Enter the following command, replacing “c:\deploy” with your
deployment folder:

aspnet_regiis -pef “connectionStrings” “c:\deploy”

The tool adds several nodes to the <connectionStrings> element, such
as <EncryptedData> and <CipherValue>. Your secrets are somewhere
within all those nonsense characters and harder to decipher than the DaVinci
code — except by ASP.NET!

This command decrypts the section:

aspnet_regiis -pdf “connectionStrings” “c:\deploy”