# How to encrypt ansible vault password

**URL:** <https://forum.ansible.com/t/how-to-encrypt-ansible-vault-password/35779>\
**Category:** Ansible Project\
**Created:** [September 24, 2021, 7:30am UTC](https://forum.ansible.com/t/how-to-encrypt-ansible-vault-password/35779 "2021-09-24T07:30:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anjali\_Adhikari](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Anjali\_Adhikari](https://forum.ansible.com/u/Anjali_Adhikari)\
**Post date:** [September 24, 2021, 7:30am UTC](https://forum.ansible.com/t/how-to-encrypt-ansible-vault-password/35779/1 "2021-09-24T07:30:32Z")

</div>

Hi All,

I am facing a challenge in getting CISO approval for my ansible project.  
**Issue:** We are using Ansible vault for keeping vars secret. However, that vault password we are keeping it in ./ path in clear text.Can we encrypt the vault password itself.

Please assist me on this ,

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![steve\_missoh](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@steve\_missoh](https://forum.ansible.com/u/steve_missoh)\
**Post date:** [September 24, 2021, 8:23am UTC](https://forum.ansible.com/t/how-to-encrypt-ansible-vault-password/35779/2 "2021-09-24T08:23:46Z")

</div>

Hi, interesting question.  
I suggest you two approaches:  
1)

- Apply strict ACL on the vault password file (like 0400 for e.g.)
- Do not version the file
- rekey it frequently

1. 

Make use of an external or third party secret manager tool to store the vault password and get access to it through a script.

Regards.

---

<div class="post-metadata">

**Author:** ![Anjali\_Adhikari](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Anjali\_Adhikari](https://forum.ansible.com/u/Anjali_Adhikari)\
**Post date:** [September 24, 2021, 9:59am UTC](https://forum.ansible.com/t/how-to-encrypt-ansible-vault-password/35779/3 "2021-09-24T09:59:12Z")

</div>

Hi Stefim,

Thanks for your reponse.Much appritaite !

regarding the third party, we tried that. We used one password to store it, but while ansible taking that password from 1password, it’s fetching in cleartext.

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [September 24, 2021, 11:48am UTC](https://forum.ansible.com/t/how-to-encrypt-ansible-vault-password/35779/4 "2021-09-24T11:48:11Z")

</div>

Eventually ansible needs the plain text