Evolution of Encrypted Credentials in Rails 6.2
Published: 2021-10-27 10:51:32

---
title: Evolution of Encrypted Credentials in Rails 6.2
published: true
description: With each update, credentials feature acquired better shape. This post will offer a peek into the evolution of encrypted credentials since its inception in Rails 5.1
tags: 
canonical_url: https://blog.engineyard.com/encrypted-credentials-in-rails-6.2-evolution?utm_source=dev.to&utm_medium=Devgraph&utm_id=QiWorks.in
//cover_image: https://blog.engineyard.com/hubfs/image1.jpg
---
![Encrypted Credentials in Rails 6.2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z7jiubb3gcabf5lbfga8.jpg)
By [Ritu Chaturvedi](https://blog.engineyard.com/author/ritu-chaturvedi)

Your blog The concept of encrypted secrets evolved and acquired a better shape with each update of the [Rails version](https://weblog.rubyonrails.org/releases/). Recently, Rails 6.2 has brought in many such updates to the credentials feature. Let us analyze and discuss encrypted credentials further, how to read them, the advantages, and finally, how to manage a secret key base.

## **Evolution of Encrypted credentials**

Encrypted secrets were introduced with Rails 5.1 in a view to bringing more security to the secrets handled. In this version, these were referred to as ‘_secrets_’ and were referenced by

![Rails Encrypted credentials](https://blog.engineyard.com/hs-fs/hubfs/image2-4.png?width=620&name=image2-4.png)

The _secrets.yml.enc_ file handles the secrets along with an encryption key.

## **Handling secrets before Rails 5.1**

&nbsp;Before this version of Rails, there were two methods to commit the secrets.&nbsp;

- The first method was to store secrets onto the _secrets.yml_ file, read secrets from environment variables, and commit the _secrets.yml_ file to the repository. Though this method was easy to operate, it had a high-security risk as any gem used can dump environment variables. Since the data is open and not encrypted, this can be read by anyone accessing the repository.
- The second method was to store all secrets in the _secrets.yml_ file and not commit them to the repository.

## **Handling secrets in Rails 5.1**

By default, from this version of Rails, the secrets were passed as secrets.yml file along with an encryption key. Without this key, the secrets stored in the file will look like some junk characters. To initiate using secrets, the user needs to run:

![encrypted credentias in rails 5.1](https://blog.engineyard.com/hs-fs/hubfs/image2-Oct-27-2021-10-26-52-86-AM.png?width=620&name=image2-Oct-27-2021-10-26-52-86-AM.png)

This would create two files: _config/secrets.yml.key_ and _config/secrets.yml.enc_. The _key_ file will hold the secret key to decrypt data in the _enc_ file.

## **Encrypted Credentials in Rails 5.2**

An update to the older secret handling, this Rails version removed plain text secrets, and only encrypted credentials were allowed. Credentials were stored in _config/credentials.yml.enc,_ and the key was stored on _config/master.key_. Thus users could deploy code and credentials together and store all credentials in one place.

Here, multi-environment credentials were handled by specifying explicitly, and the configuration was accessed by mentioning the _access\_key\_id_.

## **Encrypted Multi-environment Credentials in Rails 6.1**

The latest update made it to separate credential files for each environment. This built-in feature necessitates [separate encryption key](https://github.com/rails/rails/pull/33521) for each credential file, thus guaranteeing more security.

A global credential file is enough for multiple environments. And when the environment is passed, two files would be created:

![global credential file in rails](https://blog.engineyard.com/hs-fs/hubfs/image3-3.png?width=626&name=image3-3.png)

Here’s an example of how it works:

![global credential file in rails](https://blog.engineyard.com/hs-fs/hubfs/image5-2.png?width=628&name=image5-2.png)

If the environment file is missing or not created, the default _credentials.yml.enc_ file will be used.

Also, the _config/credential/prod.yml.enc file_ would be committed to the repository, whereas the _config/credential/prod.key_ file would not.

## **Add-ons in Rails 6**

- It is now possible to store the credentials in a location of your choice. This is explicitly mentioned by running:

_config.credentials.content\_path_ and_&nbsp;_

_config.credentials.key\_path_

Make sure to save the valid key and the credentials to avoid errors while running the code.&nbsp;

- Handle local environment credentials using

_config/credentials/environment.key_ and_&nbsp;_

_config/master.key_

- _The below command tells Rails to search the credentials file in path config/credentials/local.yml.enc instead of config/credentials/development.yml.enc_

![Add-ons in rails 6.1](https://blog.engineyard.com/hs-fs/hubfs/image4-4.png?width=625&name=image4-4.png)

Our latest guide [Rails encrypted credentials on 6.2](https://blog.engineyard.com/rails-encrypted-credentials-on-6.2) offer an interesting peek into the Rails credentials.

## **Advantages of encrypted credentials**

The main advantages of encrypted multi-environment credentials are as follows:

- Safety: The separate encryption key for each environment makes it safer
- Easy deployments: since the variables can be moved along with the code, deployments become easier
- A single upload of the key is enough
- The solution applies to any of the Ruby on Rails applications

## **Conclusion**

Rails is constantly improving the efficiency and scalability of the framework. With the multi-environment credentials enabled, applications used in multiple platforms and POD find it easier to keep the codes simple and accessible.

Know how to use [Engine Yard Kontainers](https://support.cloud.engineyard.com/hc/en-us/articles/360058941713-How-Kontainers-Works) to connect to your database, enabling the Rails credentials for improved security.

To learn more about the older versions of credentials, check out [Encrypted Rails Secrets on Rails 5.1](https://blog.engineyard.com/encrypted-rails-secrets-on-rails-5.1)