What is Ansible Vault?

Ansible Vault is a built-in feature of Ansible that encrypts sensitive data such as passwords, API keys, and certificates so they can be safely stored alongside playbooks and roles in version control. It uses AES-256 symmetric encryption with PBKDF2 key derivation, meaning a single password is used for both encryption and decryption. Vault-encrypted content is identified by the $ANSIBLE_VAULT;1.1;AES256 header followed by hex-encoded ciphertext.

Ansible Vault solves a fundamental DevOps challenge: how to keep secrets in the same repository as infrastructure code without exposing them. Instead of managing separate secret stores or relying on environment variables, teams can commit encrypted files directly to Git and decrypt them at runtime during playbook execution.

Tool description

This tool encrypts and decrypts Ansible Vault content directly in the browser. Enter a vault password and plaintext to produce a fully compatible encrypted vault blob, or paste an existing vault blob to reveal the original secret. No data leaves the browser — all cryptographic operations run client-side.

Examples

Encrypting plaintext:

Input (plaintext):

db_password: s3cur3P@ss!

Output (encrypted vault):

$ANSIBLE_VAULT;1.1;AES256
33383239333036363833303565653032383832663162356533343630623030613133623032636566
6536303436646561356461623866386133623462383832620a646363626137626635353462386430
34333937313366383038346135656563316236313139333933383139376333353266666436316536
6335376265313432610a313537363637383264646261303637646631346137393964386432313633
3666

Decrypting vault content:

Paste the encrypted block above with the correct password to recover the original db_password: s3cur3P@ss! value.

Features

  • AES-256 encryption fully compatible with Ansible Vault 1.1 format
  • Client-side only — no data is sent to any server
  • Supports both encryption and decryption with a single password field
  • Instant conversion with live preview as you type
  • Works with multi-line secrets, YAML fragments, and arbitrary text

Use cases

  • Quickly encrypting a new secret before committing it to a Git repository containing Ansible playbooks
  • Decrypting and inspecting vault content during debugging without needing Ansible installed locally
  • Sharing encrypted secrets with teammates who can decrypt them in the browser using a shared vault password

How it works

Ansible Vault 1.1 uses the following process:

  1. Key derivation — PBKDF2-HMAC-SHA256 derives a 80-byte key from the password and a random salt (10,000 iterations). The key is split into a 32-byte encryption key, a 32-byte HMAC key, and a 16-byte IV.
  2. Encryption — The plaintext is encrypted with AES-256-CTR using the derived key and IV.
  3. Authentication — An HMAC-SHA256 is computed over the ciphertext to ensure integrity.
  4. Encoding — The salt, HMAC digest, and ciphertext are hex-encoded and combined under the $ANSIBLE_VAULT;1.1;AES256 header.

Decryption reverses the process: the password re-derives the same keys, verifies the HMAC, and decrypts the ciphertext.

Limitations

  • Only supports the Ansible Vault 1.1 format with AES-256 encryption
  • Does not support vault ID labels for multi-password setups
  • Large files may cause brief UI delays due to the CPU-intensive key derivation step