# Using binary data in Ansible Vaults.

**URL:** <https://forum.ansible.com/t/using-binary-data-in-ansible-vaults/17114>\
**Category:** Ansible Project\
**Created:** [December 19, 2014, 10:34pm UTC](https://forum.ansible.com/t/using-binary-data-in-ansible-vaults/17114 "2014-12-19T22:34:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen\_Gargan](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@Stephen\_Gargan](https://forum.ansible.com/u/Stephen_Gargan)\
**Post date:** [December 19, 2014, 10:34pm UTC](https://forum.ansible.com/t/using-binary-data-in-ansible-vaults/17114/1 "2014-12-19T22:34:11Z")

</div>

I’ve been using a pattern of base64 encoded values and jinja templates deal with storing binary data in vaults and have put together scripts to simplify the process; I’ve found them pretty useful and figured others might get some use out of them.

[https://github.com/sgargan/ansible-vault-tools](https://github.com/sgargan/ansible-vault-tools)

I’ve considered writing a dedicated module to take the place of the playbook and template, but in the meantime this works pretty well.

regards,

Steve.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [December 20, 2014, 12:55am UTC](https://forum.ansible.com/t/using-binary-data-in-ansible-vaults/17114/2 "2014-12-20T00:55:39Z")

</div>

If the primary goal of this is to encrypt the value given to the “src” of a copy operation (or template operation), I wonder if there’s a better way to make this happen without needing to shell out to an extra CLI.

It might require vault knowing that a file is not YAML when it is executed though…

---

<div class="post-metadata">

**Author:** ![Stephen\_Gargan](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@Stephen\_Gargan](https://forum.ansible.com/u/Stephen_Gargan)\
**Post date:** [December 20, 2014, 1:34am UTC](https://forum.ansible.com/t/using-binary-data-in-ansible-vaults/17114/3 "2014-12-20T01:34:28Z")

</div>

Building this into the copy plugin would definitely be the way to go; the vault header could have a flag to denote the contents and distinguish binary from yaml.