[ENCRYPT & DECRYPT CONFIG FILES]

Config files are plain text holding live credentials — the single most under-protected file on most systems.

An OpenVPN .ovpn profile usually contains an inline private key and certificate. A WireGuard .conf contains PrivateKey in the clear. A .env file holds database passwords and API tokens. All three are plain text, and all three routinely get emailed, pasted into chat, and committed to repositories.

Encrypting them before they move is quick and runs entirely in your browser, so the credentials never reach a server.

ENCRYPT_FILE_ONLINE_v1.0.0
🔒 [ENCRYPT] 🔓 [DECRYPT]

[1] SELECT FILE

[2] CHOOSE ENCRYPTION ALGORITHM

[4] ENCRYPT FILE

[WHAT IS ACTUALLY INSIDE THESE FILES]

File Sensitive contents
.ovpnInline <key> private key, <cert>, <tls-auth>, sometimes auth-user-pass credentials
.confWireGuard PrivateKey and PresharedKey, both plain text
.envDatabase URLs, API keys, secret keys, tokens
.yml / .yamlKubernetes secrets, CI credentials, service passwords
.pem / .keyPrivate keys — sometimes passphrase-protected, often not
.rdp / .ppkRemote-desktop and PuTTY session keys

Anyone who obtains an .ovpn file with an inline key can usually connect to that network as you. It is a credential, not a settings file, and deserves the same handling as a password.

[IF YOUR CONFIG CAME ALREADY ENCRYPTED]

Some vendors ship configuration files their own client decrypts — Fortinet, Cisco AnyConnect, SonicWall and various consumer VPN apps all do variations of this. Those use proprietary formats and this tool cannot read them. Use the vendor's client, or ask your network administrator for a standard profile.

Two related things that look like encryption but are not:

  • Cisco "type 7" passwords in router configs are obfuscated with a published, trivially reversible scheme. They are not encrypted in any meaningful sense — treat them as plain text.
  • Base64-encoded blobs inside config files are encoding, not encryption. Anyone can decode them.

By contrast, Cisco type 5, 8 and 9 passwords are hashes. They cannot be decrypted at all, by anyone — there is no original to recover.

[PRACTICAL HANDLING]

  • Never email a config and its password together. Send the encrypted file one way and the key another.
  • Never commit one to Git, even privately. Repository history is forever, and a later access change exposes the whole history. If it has already happened, rotate the credentials rather than just deleting the file — the old commit still contains them.
  • Encrypt before it touches cloud sync. Dropbox and OneDrive keep version history that survives local deletion.
  • Rotate rather than recover. If a config has leaked, issuing a new key is faster and safer than assessing who saw it.
  • For short values, use text mode. A single API key or connection string is easier to paste through the text encryption tool than to send as a file.

[HOW TO ENCRYPT A VPN OR CONFIG FILE]

Encrypt a configuration file containing credentials before sending or storing it.

  1. Select the config file. Choose your .ovpn, .conf, .env, .yaml or .pem file. Any text-based configuration works.
  2. Enable compression. Config files are plain text and compress very well, so the encrypted output is often much smaller than the original.
  3. Choose a password or random key. Use a long passphrase or generate a random 256-bit key, and store it in a password manager.
  4. Send the file and the key separately. Email the encrypted file and pass the key by phone or a different messaging app, so intercepting one channel is not enough.
  5. Rotate anything already exposed. If the config was previously sent unencrypted or committed to a repository, issue new credentials rather than relying on deletion.

[FREQUENTLY ASKED QUESTIONS]

How do I decrypt a VPN config file?

If it is a .enc file from this site, use the tool on this page with the password or key. If your VPN vendor supplied an already-encrypted profile in their own format — Fortinet, Cisco AnyConnect and similar — only their client can read it, and you should request a standard profile from your administrator.

Why should I encrypt an .ovpn file?

Because it usually contains an inline private key and certificate, which together are enough for someone else to connect to that network as you. It is a credential rather than a settings file, and emailing it unencrypted is equivalent to emailing a password.

Can you decrypt a Cisco type 7 password?

Type 7 is obfuscation, not encryption — the scheme is published and reversible by anyone, so those values should be treated as plain text. Type 5, 8 and 9 are hashes and cannot be decrypted at all, because hashing destroys the original by design.

Is it safe to encrypt a config file in a browser?

Here, yes, because nothing is uploaded — encryption runs locally via the Web Crypto API and you can confirm that in your browser Network tab. Be much more careful with services that require an upload, since a config file often contains live credentials.

I committed a config file to Git. Is deleting it enough?

No. Git retains the full history, so the credentials remain retrievable from earlier commits even after deletion, and anyone with repository access can recover them. Rotate the credentials immediately, then clean the history if needed. Rotation is the step that actually fixes the exposure.