diff --git a/conf/application.conf.default b/conf/application.conf.default
index eee2cb3753..1279bf4adc 100644
--- a/conf/application.conf.default
+++ b/conf/application.conf.default
@@ -1,4 +1,7 @@
 include "base"
 include "version"
 
+# change for additional encryption of password hashes
+user.password.bpass.secret = "9qEYN0ThHer1KWLNekA76Q=="
+
 # override values from base.conf here
diff --git a/conf/base.conf b/conf/base.conf
index 5621216673..a7c8b2b2ba 100644
--- a/conf/base.conf
+++ b/conf/base.conf
@@ -30,7 +30,7 @@ play {
       cookieName = "lila2"
       maxAge = 3650 days
     }
-    secret.key = "CiebwjgIM9cHQ;I?Xk:sfqDJ;BhIe:jsL?r=?IPF[saf>s^r0]?0grUq4>q?5mP^"
+    secret.key = "CiebwjgIM9cHQ;I?Xk:sfqDJ;BhIe:jsL?r=?IPF[saf>s^r0]?0grUq4>q?5mP^" # public (lila does not rely on cookie signing)
   }
   ws {
     useragent = "lichess.org"
@@ -413,9 +413,6 @@ user {
     trophyKind = trophyKind
     ranking = ranking
   }
-  password.bpass {
-    secret = "9qEYN0ThHer1KWLNekA76Q=="
-  }
 }
 fishnet {
   redis = ${redis}