msencrypt(1)

💖 NAME

msencrypt — bestie, this one makes encryption keys, or it encrypts little chunks of your connection strings so you can stash them in mapfiles 🎀

---

✨ SYNOPSIS

msencrypt [-keygen file | -key file string]

---

🦋 DESCRIPTION

So msencrypt does two things, and honestly both are iconic: it can create an encryption key, and it can encrypt portions of connection strings for use in mapfiles. No cap. 💅

Like, the classic glow-up situation is that you wanna encrypt portions of the CONNECTION parameter for a database connection. Because putting your raw password in a mapfile? We don't do that here. 🙈

These CONNECTIONTYPEs are the ones supported for using this encryption method:

• OGR
• Oracle Spatial
• PostGIS
• SDE

---

🌸 OPTIONS

• -keygen file — Creates a new encryption key in file. New key, fresh start, main character energy. 🔑✨
• -key file string — Use the key in file to encrypt string. Periodt.

---

💜 NOTES

Use in Mapfile.

Where does the encryption key live? Two mechanisms, pick your fighter:

• setting the environment variable MS_ENCRYPTION_KEY, or
• using a CONFIG directive in the MAP object of your mapfile.

For example:

CONFIG MS_ENCRYPTION_KEY "/path/to/mykey.txt"

And when you're dropping encrypted strings inside database CONNECTIONs in your mapfile, use the { and } characters as delimiters. Like this:

CONNECTIONTYPE ORACLESPATIAL
CONNECTION "user/{MIIBugIBAAKBgQCP0Yj+Seh8==}@service"

The curly braces are literally the whole vibe. Don't skip them. 🫶

---

🌈 EXAMPLE

Okay bestie, here's a whole layer to look at:

LAYER
  NAME "provinces"
  TYPE POLYGON
  CONNECTIONTYPE POSTGIS
  CONNECTION "host=127.0.0.1 dbname=gmap user=postgres password=iluvyou18 port=5432"
  DATA "the_geom FROM province using SRID=42304"
  STATUS DEFAULT
  CLASS
    NAME "Countries"
    COLOR 255 0 0
  END
END

Here are the steps to encrypt the password in the above connection:

1. Generate an encryption key — and note that this key should not be stored anywhere within your web server's accessible directories:

msencrypt -keygen "/home/user/mykey.txt"

And this generated key file might contain something like:

2137FEFDB5611448738D9FBB1DC59055

2. Encrypt the connection's password using that generated key:

msencrypt -key "/home/user/mykey.txt" "iluvyou18"

Which returns the password encrypted, at the commandline (you'll use it in a second):

3656026A23DBAFC04C402EDFAB7CE714

3. Edit the mapfile to make sure the 'mykey.txt' can be found, using the "MS_ENCRYPTION_KEY" environment variable. The CONFIG parameter inside the MAP object can be used to set an environment variable inside a mapfile:

MAP
    ...
    CONFIG "MS_ENCRYPTION_KEY" "/home/user/mykey.txt"
    ...
END #mapfile

4. Modify the layer's CONNECTION to use the generated password key, making sure to use the "{}" brackets around the key:

CONNECTION "host=127.0.0.1 dbname=gmap user=postgres
            password={3656026A23DBAFC04C402EDFAB7CE714} port=5432"

5. Done! Give your new encrypted mapfile a try with the map2img(1) utility!

---

You did it. Your secrets are safe, your mapfile is encrypted, and you are absolutely serving. 👑💖

---

That's the whole page, bestie — msencrypt(1), dated 22 August 2026. Go forth and encrypt, slay, and never commit a plaintext password again. 🦋✨💅