title: Best practice for storing passwords that need to be reused?
body: <p>We have an automation platform that needs to store service account passwords in a database.</p>
  
  <p>These passwords are used in a variety of different cases but generally need to be reversed into their original plain text form in order to be functional.</p>
  
  <p>The service accounts are all compartmentalized to do very specific things - however, I'm uncomfortable leaving them in the database in plain text.</p>
  
  <p>What is the best method/technique for storing passwords in a database when they need to be reversible?</p>
  
  <p>For specific recommendations the platform is using <strong>C#, .Net MVC</strong>, and MySQL (MariaDB).</p>
  
  <p>My immediate plan would be to store them after signing them with a non-exportable private key held in the local key store on the application server. Then reversing the encryption method when reading them out of the database.</p>
  
  <p>If this is the technique I should be using are there particular methods I should be aware of?</p>
  
  <p>Thank you for any help or information.</p>
  
  <p><strong>[Edited To Re-Open and remove the "Opinion Based" classification. Microsoft had particular documentation for this exact use case. I can't add an answer or mark as answered until it is but my solution is as follows:]</strong></p>
  
  <p>The recommendation from the Microsoft Engineering team was to use the <a href="https://msdn.microsoft.com/en-us/library/system.web.security.machinekey.protect(v=vs.110).aspx#See%20Also" rel="nofollow noreferrer">Machine Key class and methods</a>.</p>
  
  <p>Utilizing a machine key set and generated via IIS and a uniquely generated "purposes" string provided to the Protect method I can securely encrypt and decrypt a column and leave it secure while at rest.</p>
  
  <p>In MariaDB (MySQL) you'll need to use a column of tinyblob to store the byte array.</p>
  
  <p>I don't believe this is an opinion based answer since this is the defacto way to do it with the technologies specified in the question.</p>
  
  <p><a href="https://i.stack.imgur.com/jU2l2.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jU2l2.jpg" alt="IIS Machine Key"></a></p>