# encryption

**URL:** <https://forum.ansible.com/t/encryption/17527>\
**Category:** Ansible Project\
**Created:** [February 16, 2015, 4:56pm UTC](https://forum.ansible.com/t/encryption/17527 "2015-02-16T16:56:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexey\_Wasilyev1](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@Alexey\_Wasilyev1](https://forum.ansible.com/u/Alexey_Wasilyev1)\
**Post date:** [February 16, 2015, 4:56pm UTC](https://forum.ansible.com/t/encryption/17527/1 "2015-02-16T16:56:26Z")

</div>

Hello!

Is there any way to encrypt just values in the variable files?  
I need something like

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [February 16, 2015, 4:58pm UTC](https://forum.ansible.com/t/encryption/17527/2 "2015-02-16T16:58:40Z")

</div>

not currently, vault only supports full file encryption (you do't need  
to encrypt all your vars, just the secrets).

---

<div class="post-metadata">

**Author:** ![Mark\_Janssen](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@Mark\_Janssen](https://forum.ansible.com/u/Mark_Janssen)\
**Post date:** [February 17, 2015, 1:28pm UTC](https://forum.ansible.com/t/encryption/17527/3 "2015-02-17T13:28:05Z")

</div>

You could load in encrypted vars via a lookup to something like pass ([passwordstore.org](http://passwordstore.org)).

- name: Debug  
debug: msg={{lookup(‘pipe’, ‘pass some/password/i/need’) }}

This way you can store your passwords as gpg-encrypted files, and even version them along with your plays.

---

<div class="post-metadata">

**Author:** ![Alexey\_Wasilyev1](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@Alexey\_Wasilyev1](https://forum.ansible.com/u/Alexey_Wasilyev1)\
**Post date:** [February 17, 2015, 4:53pm UTC](https://forum.ansible.com/t/encryption/17527/4 "2015-02-17T16:53:39Z")

</div>

Finally I make a local clone of action\_plugins/include\_var.py and patch it to recognise encrypted values.