Storing Passwords in Confluence

[Dan]

Hi,

We are hoping to store passwords in Confluence for certain resources such as server accounts and passwords. While storing passwords in plain text is not advisable we have to maintain a central record of them somewhere that a distributed team is able to access. We are currently running on the Cloud version of Confluence.

Is there any feature or function that would allow us to encrypt or hide the passwords directly in confluence? We cam always encrypt them in a different tool and place the encrypted text in confluence but this is cumbsersome.
Having the ability to do this (especially user based security) in Confluence would be great or alternatively some form of browser plugin to encrypt/decrypt the text.

Does anyone know how this could be achieved?

[Aron Gombas _Midori_ · Accepted solution]

There are multiple add-ons that can encrypt content and store that in secured format even in the database. These are only available for the Server edition:

1. https://marketplace.atlassian.com/plugins/net.customware.confluence.plugin.vault/server/overview (this one comes from a well established vendor and I think that is key)
2. https://marketplace.atlassian.com/plugins/com.prcpo.confluence.plugins.secure-content-block/server/overview
3. https://marketplace.atlassian.com/plugins/dk.translucent.atlassian.confluence.crypto-plugin/server/overview

For the cloud, I found only one. You should check if rely on this service, because you are storing/handling secure information in a 3rd party service:

1. https://marketplace.atlassian.com/plugins/com.g2.vsecure/cloud/overview

(Note: this last one is not supported, which isn't a good sign.)

[Michael R]

Hi,

this article is a bit older, but may still be relevant for some people.
There is an add on for Confluence Cloud (Secure Content) that does exactly what the questioner wants. You can store passwords directly in Confluence and show or hide them. The data is also encrypted.
Here is the link to the add on:

https://marketplace.atlassian.com/apps/1226391/secure-content-for-confluence-cloud?hosting=cloud&tab=overview

Regards,
Michael

[Sandy Johnson]

I'm sure there are more answers, but 2 come to mind:

1. you can restrict access to the page to only those people who need access
2. attach an Excel or Word file and password protect that file

That said, I'm not sure I'm in favor of using Confluence as my source for passwords

[Ryan Evans]

"I'm not sure I'm in favor of using Confluence as my source for passwords"

Atlassian, are you listening?..

[Michael R]

Yet another reason to use SecureContent.

Atlassian (and also the publisher of the AddOn) do not have access to the passwords there.
Reason:
- The encrypted data is attached directly to the client's page to which the publisher has no access.
- To decrypt the data you need the algorithm on the publisher's server (Atlassian has no access)
- Even if the publisher or Atlassian had the user's encrypted data from SecureContent, a valid user session would be required to decrypt the data.