---
title: "Encrypt and Decrypt Strings"
description: "How to encrypt and decrypt Corridor configuration setting values with the settings encrypt/decrypt commands, and the algorithm used."
---

Corridor supports builtin encryption methods to encrypt settings in the configuration file. This
could be used to encrypt sensitive values like database passwords.

It is recommended to use password/key managers like Vault, KMS, etc. but in smaller cases, using the
Corridor encryption method improves the security of the application.

This is commonly used for settings like: `SQLALCHEMY_DATABASE_URI`, `CELERY_BROKER_URL` in the [API configuration](/technology/installation/configuration-setup/api/).

The encrypted settings can be configured in `api_config.secret.py` file which needs to be placed
near the `api_config.py`.

To encrypt a setting value, run the command:

```bash
corridor-api settings encrypt <<string_to_encrypt>>
```

To decrypt an encrypted setting value, run the command:

```bash
corridor-api settings decrypt <<encrypted_string>>
```

This command is only available for `corridor-api` and `corridor-worker` and encryption is only supported
for `corridor-api` and `corridor-worker` settings.

To check the options available for `corridor-worker`:

```bash
corridor-worker settings --help
```

## Encryption algorithm

Corridor uses `PBKDF2` with `HMAC` as pseudorandom function and `SHA256` encryption algorithm to encrypt the settings
values.

## Example

An encrypted value can be decrypted using the decrypt command

```bash
settings_value=abc123
echo "Original value : ${settings_value}"

encrypted_value=$(corridor-api settings encrypt $settings_value)
echo "Encrypted value: ${encrypted_value}"

decrypted_value=$(corridor-api settings decrypt $encrypted_value)
echo "Decrypted value: ${decrypted_value}"
```