ansible-vault(1)
Encrypt and decrypt sensitive data in Ansible playbooks and variable files.
Synopsis
ansible-vault [create|edit|view|encrypt|decrypt|rekey|encrypt_string] [options] file_nameDescription
ansible-vault is a tool for encrypting sensitive data in Ansible projects, such as passwords, API keys, and credentials. It uses AES-256 encryption to protect content while keeping files readable to Ansible during playbook execution.
Vault works by prompting for a password that encrypts/decrypts files. The same password is required to run playbooks containing encrypted content. You can manage multiple vault passwords and encrypt individual strings rather than entire files.
Common options
| Flag | What it does |
|---|---|
create | Create a new encrypted file; prompts for vault password |
edit | Edit an encrypted file; decrypts temporarily, re-encrypts on save |
view | Display encrypted file contents without editing |
encrypt | Encrypt an existing plaintext file |
decrypt | Permanently decrypt a file to plaintext |
encrypt_string | Encrypt a string value for use in playbooks |
--vault-password-file FILE | Read vault password from file instead of prompting |
--vault-id ID@FILE | Use specific vault identity with password from file |
-p, --prompt | Prompt for vault password (default behavior) |
--new-vault-password-file FILE | Use new password file when rekeying |
--output FILE | Write encrypted output to file (for encrypt_string) |
Examples
Create a new encrypted file, prompts for password, opens in editor
ansible-vault create secrets.ymlDecrypt and edit existing vault file, automatically re-encrypts on save
ansible-vault edit secrets.ymlDisplay encrypted file contents without opening in editor
ansible-vault view secrets.ymlEncrypt an existing plaintext YAML file
ansible-vault encrypt vars.ymlPermanently decrypt a vault file back to plaintext
ansible-vault decrypt secrets.ymlEncrypt a single string value; outputs encrypted format ready for YAML
ansible-vault encrypt_string 'mypassword' --name 'db_password'Change the password protecting a vault file
ansible-vault rekey secrets.ymlRun playbook with encrypted files using password from file (non-interactive)
ansible-playbook playbook.yml --vault-password-file ~/.vault_pass