# How ansible vault is safe when using scripts? **URL:** \ **Category:** Ansible Project\ **Created:** [March 22, 2022, 11:05am UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468 "2022-03-22T11:05:25Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![batchenr](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/batchenr/32/7123_2.png) [@batchenr](https://forum.ansible.com/u/batchenr)\ **Post date:** [March 22, 2022, 11:05am UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468/1 "2022-03-22T11:05:25Z")
Hey, I dont understand how ansible vault is safe if i want to use in a script i need to give ansible the file where the password is saved in plain text… so i dont get it i do get it being safe if i do a prompts for the password with --ask-vault-pass but when i point to ansible using --vault-password-file or export global variable with pass it is saved on the system\file as plain text what am i missing? Thanks! ---
**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\ **Post date:** [March 22, 2022, 11:15am UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468/2 "2022-03-22T11:15:38Z")
> Hey, > I dont understand how ansible vault is safe if i want to use in a script i need to give ansible > the file where the password is saved in plain text.. so i dont get it > > i do get it being safe if i do a prompts for the password with --ask-vault-pass > but when i point to ansible using --vault-password-file or export global variable with pass it is saved on the system\file as plain text > > what am i missing? You can use a GPG encrpyted password file with a wrapper script. Regards         Racke ---
**Author:** ![Akasurde](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/akasurde/32/230_2.png) [@Akasurde](https://forum.ansible.com/u/Akasurde)\ **Post date:** [March 22, 2022, 11:46am UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468/3 "2022-03-22T11:46:43Z")
You can use this [https://docs.ansible.com/ansible/latest/user\_guide/vault.html?extIdCarryOver=true&sc\_cid=701f2000001Css5AAC#storing-passwords-in-third-party-tools-with-vault-password-client-scripts](https://docs.ansible.com/ansible/latest/user_guide/vault.html?extIdCarryOver=true&sc_cid=701f2000001Css5AAC#storing-passwords-in-third-party-tools-with-vault-password-client-scripts) ---
**Author:** ![batchenr](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/batchenr/32/7123_2.png) [@batchenr](https://forum.ansible.com/u/batchenr)\ **Post date:** [March 27, 2022, 2:17pm UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468/4 "2022-03-27T14:17:13Z")
I have tried using the gpg script works amazing BUT - the gpg file askes randomly the password again and again so i cannot really relay on that. i used like this : gpg-wrapper.sh - #!/bin/sh VAULT\_PW\_FILENAME=“/base/vaults/vault.gpg” gpg --quiet --batch --use-agent --decrypt $VAULT\_PW\_FILENAME ansible.cfg - vault\_password\_file = /base/vaults/gpg-wrapper.sh encrypted like this: gpg --quiet --batch --use-agent --decrypt vault ב-יום שלישי, 22 במרץ 2022 בשעה 13:16:01 UTC+2, [ra...@linuxia.de](mailto:ra...@linuxia.de) כתב/ה: ---
**Author:** ![batchenr](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/batchenr/32/7123_2.png) [@batchenr](https://forum.ansible.com/u/batchenr)\ **Post date:** [March 27, 2022, 2:19pm UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468/5 "2022-03-27T14:19:29Z")
sorry i encrypted like this: gpg -c vault ב-יום ראשון, 27 במרץ 2022 בשעה 17:17:13 UTC+3, ‪R Batchen‬‏ כתב/ה: ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [March 27, 2022, 4:56pm UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468/6 "2022-03-27T16:56:02Z")
An option would be to use gpg-agent. Depending on your setup that might automagically unlock when you sign in to the computer you use to run ansible playbooks. For example I know that on macOS you can store the gpg password in the OS' keychain. ---
**Author:** ![batchenr](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/batchenr/32/7123_2.png) [@batchenr](https://forum.ansible.com/u/batchenr)\ **Post date:** [March 29, 2022, 8:49am UTC](https://forum.ansible.com/t/how-ansible-vault-is-safe-when-using-scripts/36468/7 "2022-03-29T08:49:00Z")
I work on ubuntu host and the ansible playbooks run on docker container with ubuntu ill try to look into gpg agent for docker container - thanks! ב-יום ראשון, 27 במרץ 2022 בשעה 19:56:24 UTC+3, [dick....@geant.org](mailto:dick....@geant.org) כתב/ה: