Evolution of Encrypted Credentials in Rails 6.2

Share on facebook
Share on twitter
Share on linkedin

Your blog The concept of encrypted secrets evolved and acquired a better shape with each update of the Rails version. Recently, Rails 6.2 has brought in many such updates to the credentials feature. Let us analyze and discuss encrypted credentials further, how to read them, the advantages, and finally, how to manage a secret key base.

Evolution of Encrypted credentials

Encrypted secrets were introduced with Rails 5.1 in a view to bringing more security to the secrets handled. In this version, these were referred to as ‘secrets’ and were referenced by

Rails Encrypted credentials

The secrets.yml.enc file handles the secrets along with an encryption key.

Handling secrets before Rails 5.1

 Before this version of Rails, there were two methods to commit the secrets. 

  • The first method was to store secrets onto the secrets.yml file, read secrets from environment variables, and commit the secrets.yml file to the repository. Though this method was easy to operate, it had a high-security risk as any gem used can dump environment variables. Since the data is open and not encrypted, this can be read by anyone accessing the repository.
  • The second method was to store all secrets in the secrets.yml file and not commit them to the repository.

Handling secrets in Rails 5.1

By default, from this version of Rails, the secrets were passed as secrets.yml file along with an encryption key. Without this key, the secrets stored in the file will look like some junk characters. To initiate using secrets, the user needs to run:

encrypted credentias in rails 5.1

This would create two files: config/secrets.yml.key and config/secrets.yml.enc. The key file will hold the secret key to decrypt data in the enc file.

You might also like:   The Ruby Unbundled Series: Track How Customers Use New Features

Encrypted Credentials in Rails 5.2

An update to the older secret handling, this Rails version removed plain text secrets, and only encrypted credentials were allowed. Credentials were stored in config/credentials.yml.enc, and the key was stored on config/master.key. Thus users could deploy code and credentials together and store all credentials in one place.

Here, multi-environment credentials were handled by specifying explicitly, and the configuration was accessed by mentioning the access_key_id.

Encrypted Multi-environment Credentials in Rails 6.1

The latest update made it to separate credential files for each environment. This built-in feature necessitates separate encryption keyfor each credential file, thus guaranteeing more security.

A global credential file is enough for multiple environments. And when the environment is passed, two files would be created:

global credential file in rails

Here’s an example of how it works:

global credential file in rails

If the environment file is missing or not created, the default credentials.yml.enc file will be used.

Also, the config/credential/prod.yml.enc file would be committed to the repository, whereas the config/credential/prod.key file would not.

Add-ons in Rails 6

  • It is now possible to store the credentials in a location of your choice. This is explicitly mentioned by running:

config.credentials.content_path and 


Make sure to save the valid key and the credentials to avoid errors while running the code. 

  • Handle local environment credentials using

config/credentials/environment.key and 


  • The below command tells Rails to search the credentials file in path config/credentials/local.yml.enc instead of config/credentials/development.yml.enc

Add-ons in rails 6.1

Our latest guide Rails encrypted credentials on 6.2offer an interesting peek into the Rails credentials.

Advantages of encrypted credentials

The main advantages of encrypted multi-environment credentials are as follows:

  • Safety: The separate encryption key for each environment makes it safer
  • Easy deployments: since the variables can be moved along with the code, deployments become easier
  • A single upload of the key is enough
  • The solution applies to any of the Ruby on Rails applications
You might also like:   Tutorial on how to use Active Storage on Rails 6.2


Rails is constantly improving the efficiency and scalability of the framework. With the multi-environment credentials enabled, applications used in multiple platforms and POD find it easier to keep the codes simple and accessible.

Know how to use Engine Yard Kontainersto connect to your database, enabling the Rails credentials for improved security.

To learn more about the older versions of credentials, check out Encrypted Rails Secrets on Rails 5.1

Want more posts like this?

What you should do now:

Share on facebook
Share on twitter
Share on linkedin

Easy Application Deployment to AWS

Focus on development, not on managing infrastructure

Deploying, running and managing your Ruby on Rails app is taking away precious resources? Engine Yard takes the operational overhead out of the equation, so you can keep innovating.

  • Fully-managed Ruby DevOps
  • Easy to use, Git Push deployment
  • Auto scaling, boost performance
  • Private, fully-configured Kubernetes cluster
  • Linear pricing that scales, no surprises
  • Decades of Ruby and AWS experience

14 day trial. No credit card required.