Check out the article by Dave Hayden on ways to protect your sensitive data:

http://davidhayden.com/blog/dave/archive/2005/11/17/2572.aspx

::raises hand:: I do this on my site -- you can also encrypt sql connections!  (REALLY GOOD IDEA)

 create a button and make this its event

protected void Button1_Click(object sender, EventArgs e)

{

ProtectSection("connectionStrings", "DataProtectionConfigurationProvider");

}

to unencrypt...

protected void Button2_Click(object sender, EventArgs e)

{

UnprotectSection("connectionStrings");

}

functions are the same as given on the link above (for fun, I pasted them below), and don't forget to add System.Web.Configuration

private void ProtectSection(string sectionName, string provider)

{

Configuration config = WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);

ConfigurationSection section = config.GetSection(sectionName);

if (section != null && !section.SectionInformation.IsProtected)

{

section.SectionInformation.ProtectSection(provider);

config.Save();

}

}

private void UnprotectSection(string sectionName)

{

Configuration config = WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);

ConfigurationSection section = config.GetSection(sectionName);

if (section != null && section.SectionInformation.IsProtected)

{

section.SectionInformation.UnprotectSection();

config.Save();

}

}

Only drawback of using the DataProtectionConfigurationProvider provider, is that it uses the DPAPI (Data Protection API) which has a Machine Key based secret key used for encryption / decryption, which means that you cannot encrypt the string on your local machine, then upload the file onto the server. The encryption will have to be done on the server itself.

But to just encrypt a bunch of conn strings / config settings to prevent the casual user from having a snoop, this works great! :)