Jasypt Encryption in Java: Secure Your Database Passwords

When building applications, securing sensitive data like database passwords is crucial.

Photo by Erik Gazi on Unsplash

Hardcoding passwords in configuration files is a bad practice that makes your application vulnerable. Jasypt (Java Simplified Encryption) provides an easy-to-use encryption library to protect sensitive data.

Get Full Stack Developer’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In this article, we’ll discuss how to use Jasypt to encrypt database passwords, its benefits, limitations, and a step-by-step guide with code examples.

What is Jasypt?

Jasypt simplifies encryption and decryption in Java applications by providing a standard way to integrate encryption mechanisms. It supports strong algorithms like AES and PBEWithMD5AndDES. With Jasypt, you can seamlessly protect sensitive configuration data.

Pros of Jasypt

1. Ease of Use: Simple API for encrypting and decrypting values.
2. Integration with Spring Boot: Works seamlessly with Spring Boot applications.
3. Algorithm Variety: Supports a range of encryption algorithms.
4. Transparency: Encrypted values are automatically decrypted at runtime.
5. Security: Prevents exposing sensitive information in configuration files.

Cons of Jasypt

1. Performance Overhead: Encryption and decryption add processing overhead.
2. Key Management: Requires secure management of the encryption key.
3. Complexity for Large Applications: For large-scale systems, advanced encryption tools may provide better integration and scalability.
4. Not Tamper-Proof: While it encrypts sensitive data, it does not prevent tampering.

Setting Up Jasypt in a Java Project

(I have shown typical Jasypt Encryption, you can also you jasypt-spring-boot-starter . Example is at the end.)

1. Add Jasypt Dependency

For Maven:

<dependency>
    <groupId>org.jasypt</groupId>
    <artifactId>jasypt</artifactId>
    <version>1.9.3</version>
</dependency>

For Gradle:

implementation 'org.jasypt:jasypt:1.9.3'

2. Encrypting the Database Password

Use Jasypt’s CLI utility or write a script to encrypt the password.

Using CLI:

Run the following command:

####BASH####

java -cp jasypt-1.9.3.jar org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI input="my_database_password" password="encryption_key" algorithm="PBEWithMD5AndDES"

This will output an encrypted password, e.g., ENC(s9fA0+1aJfi73U9).

3. Using Jasypt in Java Code

Here’s an example of encrypting and decrypting a password in Java.

Encrypt and Decrypt Programmatically

import org.jasypt.util.text.BasicTextEncryptor;

public class JasyptExample {
    public static void main(String[] args) {
        // Create an encryptor
        BasicTextEncryptor textEncryptor = new BasicTextEncryptor();
        
        // Set the encryption key
        textEncryptor.setPassword("encryption_key"); // Use a secure key
        
        // Encrypt a password
        String encryptedPassword = textEncryptor.encrypt("my_database_password");
        System.out.println("Encrypted Password: " + encryptedPassword);
        // Decrypt the password
        String decryptedPassword = textEncryptor.decrypt(encryptedPassword);
        System.out.println("Decrypted Password: " + decryptedPassword);
    }
}

4. Integrating Jasypt with Spring Boot

In a Spring Boot project, Jasypt can automatically decrypt properties at runtime.

Add Jasypt Starter Dependency

<dependency>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-spring-boot-starter</artifactId>
    <version>3.0.5</version>
</dependency>

Encrypt the Database Password

Use the CLI tool or code to encrypt the password (e.g., ENC(s9fA0+1aJfi73U9)).

Add the Encrypted Password to application.properties

spring.datasource.url=jdbc:mysql://localhost:3306/mydb
spring.datasource.username=root
spring.datasource.password=ENC(s9fA0+1aJfi73U9)
jasypt.encryptor.password=encryption_key

Configuration Class (Optional)

If you need custom configurations:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.jasypt.encryption.StringEncryptor;
import org.jasypt.encryption.pbe.PooledPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.SimpleStringPBEConfig;

@Configuration
public class JasyptConfig {
    @Bean(name = "jasyptStringEncryptor")
    public StringEncryptor stringEncryptor() {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        SimpleStringPBEConfig config = new SimpleStringPBEConfig();
        config.setPassword("encryption_key"); // Use a secure key
        config.setAlgorithm("PBEWithMD5AndDES");
        config.setKeyObtentionIterations("1000");
        config.setPoolSize("1");
        config.setProviderName("SunJCE");
        config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
        config.setStringOutputType("base64");
        encryptor.setConfig(config);
        return encryptor;
    }
}

Now, Jasypt will automatically decrypt the encrypted password at runtime.

Best Practices

1. Use a Secure Key: Store the encryption key securely, such as in environment variables or a secure vault.
2. Rotate Keys Regularly: Change the encryption key periodically to minimize security risks.
3. Encrypt Sensitive Data Only: Avoid encrypting non-sensitive data to reduce overhead.
4. Use Strong Algorithms: Prefer AES-based algorithms over DES for stronger encryption.

Jasypt-spring-boot-starter Guide —

(This doesn’t belong to me but its a good recommendation)

Thats all!!!