# Encrypted variables for hosts

**URL:** <https://forum.ansible.com/t/encrypted-variables-for-hosts/28140>\
**Category:** Ansible Project\
**Created:** [July 24, 2018, 6:22pm UTC](https://forum.ansible.com/t/encrypted-variables-for-hosts/28140 "2018-07-24T18:22:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![supermario18b](https://avatars.discourse-cdn.com/v4/letter/s/b19c9b/32.png) [@supermario18b](https://forum.ansible.com/u/supermario18b)\
**Post date:** [July 24, 2018, 6:22pm UTC](https://forum.ansible.com/t/encrypted-variables-for-hosts/28140/1 "2018-07-24T18:22:54Z")

</div>

Hi everyone,

I read about encrypted variables in the ansible documentation that the best practice to manage encrypted variables (only variables not the whole yml file) is to use a var file and a vault file in groups\_vars.

Does it make sense to do the same also for hosts?

For example host\_vars/hostname with inside:

var file (unencrypted content)  
vault file (encrypted content)

Is it a common practice?

Thanks

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [July 25, 2018, 12:09pm UTC](https://forum.ansible.com/t/encrypted-variables-for-hosts/28140/2 "2018-07-25T12:09:58Z")

</div>

It does make sense to store secrets in an encrypted vars file.

One downside of this approach is that the var names in that file also  
go under the radar.  
So hard to find in git commits etc because the entire file is encrypted.  
It you just have one or two secrets then I'd use inline encrypted vars:  
[https://docs.ansible.com/ansible/latest/user\_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml](https://docs.ansible.com/ansible/latest/user_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml)

I find this especially useful for structured vars like dicts or lists  
that only contain one or two secrets.

Dick

---

<div class="post-metadata">

**Author:** ![supermario18b](https://avatars.discourse-cdn.com/v4/letter/s/b19c9b/32.png) [@supermario18b](https://forum.ansible.com/u/supermario18b)\
**Post date:** [July 25, 2018, 4:31pm UTC](https://forum.ansible.com/t/encrypted-variables-for-hosts/28140/3 "2018-07-25T16:31:57Z")

</div>

Thanks Dick, I just tried to encrypt strings and it works fine 🙂  
It was for username and pw. If I had more variables I would’ve encrypted the whole variables file.