I'm about to deploy a small Dapp to Mainnet using infura. Built using express + truffle.

I'm curious to hear how people are storing their mnemonic value when deploying to mainnet using truffle + Infura.

All examples I've found thus far store the mnemonic value as plaintext inside truffle.js.. which seems to me like a giant red flag.

According to http://truffleframework.com/tutorials/using-infura-custom-provider :

Warning: In production, we highly recommend storing the mnemonic in another (secret) file, to reduce the risk of the mnemonic becoming known. If someone knows your mnemonic, they have all of your addresses and private keys!

I'm curious to hear how people are setting up this mnemonic secret file ? Are you just restricting perms to the mnemonic file to +r inside express (or whatever..)? Or are you encrypting the mnemonic file on the fs and then decrypting it inside express? The latter feels safer.

Perhaps someone has an example of a solution they have come up with.. ?

1 Answer 1


Using dotenv you can hide your private keys. This is a pretty good tutorial, where they explain it in more detail:


  • 2
    Please refrain from posting links(they might not always work) and instead highlight the relevant text in your posts. Commented May 29, 2018 at 15:40
  • Amazing! Thank you. I feel this should be in the truffle documentation. Given that many devs are new to this space, it's very easy to overlook something that might then have serious repercussions if deployed to mainnet. Commented May 29, 2018 at 23:55
  • @hellohihihi totally agree! Commented Jun 3, 2018 at 16:12
  • I dont think this is safe, see stackoverflow.com/questions/48699820/…
    – Reno
    Commented Nov 19, 2021 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.