jasypt-spring-boot

Using Spring Profiles

You can specify an active Spring profile when running plugin goals:

mvn jasypt:encrypt -Dspring.profiles.active=production -Djasypt.encryptor.password="mypassword"

Multi-Module Projects

In multi-module projects, use the -N flag to prevent the plugin from recursing into child modules. You must specify the full path to the configuration file:

mvn jasypt:encrypt -Djasypt.plugin.path="file:module/src/main/resources/application.properties" -Djasypt.encryptor.password="mypassword" -N

Asymmetric Encryption (PEM format)

To encrypt a value using a public key in PEM format:

mvn jasypt:encrypt-value \
  -Dspring.config.location="file:src/main/resources/application.yml" \
  -Djasypt.encryptor.public-key-format="PEM" \
  -Djasypt.encryptor.public-key-location="file:src/main/resources/publickey.pem" \
  -Djasypt.plugin.value="valueToEncrypt"

You can provide your own StringEncryptor implementation by defining a Bean in your Spring Context. If you do this, the default encryptor will be ignored.

By default, the library looks for a bean named jasyptStringEncryptor. If you want to use a different bean name, you must specify it using the jasypt.encryptor.bean property.

@Bean("jasyptStringEncryptor")
public StringEncryptor stringEncryptor() {
    PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
    SimpleStringPBEConfig config = new SimpleStringPBEConfig();
    config.setPassword("password");
    config.setAlgorithm("PBEWITHHMACSHA512ANDAES_256");
    config.setKeyObtentionIterations("1000");
    config.setPoolSize("1");
    config.setProviderName("SunJCE");
    config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
    config.setIvGeneratorClassName("org.jasypt.iv.RandomIvGenerator");
    config.setStringOutputType("base64");
    encryptor.setConfig(config);
    return encryptor;
}

You can integrate jasypt-spring-boot using one of three primary methods depending on your application structure:

1. Automatic Configuration (Recommended for most): If your application uses @SpringBootApplication or @EnableAutoConfiguration, simply add the jasypt-spring-boot-starter dependency. This enables encrypted properties across the entire Spring Environment (system properties, environment variables, command line arguments, application.properties, YAML, etc.).

2. Manual Configuration (For non-auto-configured apps): If you do not use auto-configuration annotations, add the jasypt-spring-boot dependency and annotate your main Configuration class with @EnableEncryptableProperties.

3. Granular Configuration (Specific property sources): If you want to enable encryption only for specific property sources rather than the entire environment, add the jasypt-spring-boot dependency and use @EncryptablePropertySource or @EncryptablePropertySources on your Configuration classes. This supports YAML files as of version 1.8.

<!-- Method 1: Starter dependency -->
<dependency>
        <groupId>com.github.ulisesbocchio</groupId>
        <artifactId>jasypt-spring-boot-starter</artifactId>
        <version>4.0.4</version>
</dependency>

<!-- Method 2: Manual Configuration -->
<dependency>
        <groupId>com.github.ulisesbocchio</groupId>
        <artifactId>jasypt-spring-boot</artifactId>
        <version>4.0.4</version>
</dependency>

@Configuration
@EnableEncryptableProperties
public class MyApplication {
    ...
}

<!-- Method 3: Granular Property Sources -->
@Configuration
@EncryptablePropertySource(name = "EncryptedProperties", value = "classpath:encrypted.properties")
public class MyApplication {
    ...
}

As of version 3.0.5, AES 256-GCM encryption is supported using the AES/GCM/NoPadding algorithm. You can provide the secret key via a string, a file location, or a password.

Using a Key:

• Provide a Base64 encoded key via jasypt.encryptor.gcm-secret-key-string.
• Or provide a location via jasypt.encryptor.gcm-secret-key-location (supports classpath:, file:, or relative paths).

Using a Password:

• Provide a password via jasypt.encryptor.gcm-secret-key-password.
• Configure iterations via jasypt.encryptor.key-obtention-iterations (default: 1000).
• Configure salt via jasypt.encryptor.gcm-secret-key-salt (Base64 format, default: none).
• Configure algorithm via jasypt.encryptor.gcm-secret-key-algorithm (default: PBKDF2WithHmacSHA256).

Customizing IV Generation:

• Use jasypt.encryptor.iv-generator-classname to override the default RandomIvGenerator.

### Using a key
jasypt.encryptor.gcm-secret-key-string="PNG5egJcwiBrd+E8go1tb9PdPvuRSmLSV3jjXBmWlIU="
#OR
jasypt.encryptor.gcm-secret-key-location=classpath:secret_key.b64
#OR
jasypt.encryptor.gcm-secret-key-location=file:/full/path/secret_key.b64
#OR
jasypt.encryptor.gcm-secret-key-location=file:relative/path/secret_key.b64

### Using a password
jasypt.encryptor.gcm-secret-key-password="chupacabras"
#Optional, defaults to "1000"
jasypt.encryptor.key-obtention-iterations="1000"
#Optional, defaults to 0, no salt. If provided, specify the salt string in ba64 format
jasypt.encryptor.gcm-secret-key-salt="HrqoFr44GtkAhhYN+jP8Ag=="
#Optional, defaults to PBKDF2WithHmacSHA256
jasypt.encryptor.gcm-secret-key-algorithm="PBKDF2WithHmacSHA256"