You don't say what your application is. If it's a web app, you might want to place a password file outside of your web root (as well as taking the other precautions mentioned above). If it's just for generic db apps, you may wish to have a look at Perl for Oracle DBAs. It has code/links for a centralised password server which supplies the passwords over an encrypted connection. Even if you're not using Oracle, you should be able to adapt it to your needs ... unless it's overkill for you task at hand, of course