<p>Not sure there is a <a href="https://craftcms.stackexchange.com/questions/37066/new-security-key-for-existing-database#comment44071_37066">definitive answer</a> here. :) For the use-case you're concerned about, Craft uses the security key to encrypt/decrypt data in the database. In a stock Craft installation, that's for sensitive email settings.</p>
<p>Even then, with the advent of Project Config, that's not likely an issue anymore. Those settings will get stored in Project Config files, which hopefully are using environment variables to hide their values.</p>
<p>I'd guess that 99% of plugins aren't encrypting/decrypting sensitive info and the ones that are, are probably storing that info in Project Config, so it still wouldn't be a concern.</p>

CC BY-SA 4.0
2021-01-27T13:10:34.117Z
So as long as I'm using project config, the original project's security key is never actually in play, and generating a new key for each subsequent project is safely establishing that new key for future possible use. Thanks!
Mark J. Reeves
CC BY-SA 4.0
2021-01-27T04:54:09.740Z
2021-01-27T04:54:09.740Z
Brad Bell
<p>I've been hunting through questions here, Discord, Craft docs for solutions for a boilerplate Craft CMS install. Because I want to include section &amp; field configurations, I'm planning on importing an export of the boilerplate database into a new database for the project.</p>
<p>It's documented in a few places that you can run <code>craft setup/security-key</code> (or <code>craft setup/app-id</code>) to generate a new key and store it in <code>.env</code>, but nothing says how that impacts a database that's already established. They all seem to assume you'd run that step <strong>before</strong> creating the database.</p>
<p>If you clone a project &amp; existing database that's already used that first project's security key, and you want to have a unique security key for the new project, are you breaking the ability to decrypt data that was in the initial project when you generate a new security key? I don't see any indication that Craft updates the database when you generate a new key. It just updates <code>.env</code>.</p>

CC BY-SA 4.0
2021-01-26T17:02:47.277Z
[This answer](https://craftcms.stackexchange.com/a/23230/1016) from Brad might be with a read? TLDR: unless you're encrypting data yourself in the database, you should be okay.
RitterKnight
CC BY-SA 4.0
2021-01-26T21:06:57.543Z
@RitterKnight Thanks for the reply! I did read that, but it doesn't seem definitive. I believe the conclusion was "we can't stop plugin developers from encrypting data and we can't promise we won't in the future." As I'm looking to create something I'll be using into the future, I'd like to know it's on solid footing.
Mark J. Reeves
<database><setup>
New security key for existing database
# New security key for existing database

(Asked by: username_0 on 2021-01-26)

I've been hunting through questions here, Discord, Craft docs for solutions for a boilerplate Craft CMS install. Because I want to include section & field configurations, I'm planning on importing an export of the boilerplate database into a new database for the project.

It's documented in a few places that you can run `craft setup/security-key` (or `craft setup/app-id`) to generate a new key and store it in `.env`, but nothing says how that impacts a database that's already established. They all seem to assume you'd run that step **before** creating the database.

If you clone a project & existing database that's already used that first project's security key, and you want to have a unique security key for the new project, are you breaking the ability to decrypt data that was in the initial project when you generate a new security key? I don't see any indication that Craft updates the database when you generate a new key. It just updates `.env`.

**Tags:** database, setup
> **Comments:**
> **username_1**: [This answer](https://craftcms.stackexchange.com/a/23230/1016) from Brad might be with a read? TLDR: unless you're encrypting data yourself in the database, you should be okay.  
> **username_0**: @RitterKnight Thanks for the reply! I did read that, but it doesn't seem definitive. I believe the conclusion was "we can't stop plugin developers from encrypting data and we can't promise we won't in the future." As I'm looking to create something I'll be using into the future, I'd like to know it's on solid footing.  

---

## 1 answers

### Answer by username_2 on 2021-01-27. Score: 0 | Accepted answer

Not sure there is a [definitive answer](https://craftcms.stackexchange.com/questions/37066/new-security-key-for-existing-database#comment44071_37066) here. :) For the use-case you're concerned about, Craft uses the security key to encrypt/decrypt data in the database. In a stock Craft installation, that's for sensitive email settings.

Even then, with the advent of Project Config, that's not likely an issue anymore. Those settings will get stored in Project Config files, which hopefully are using environment variables to hide their values.

I'd guess that 99% of plugins aren't encrypting/decrypting sensitive info and the ones that are, are probably storing that info in Project Config, so it still wouldn't be a concern.

> **Comments:**
> **username_0**: So as long as I'm using project config, the original project's security key is never actually in play, and generating a new key for each subsequent project is safely establishing that new key for future possible use. Thanks!  

---

