diff --git a/app/api/credentials/[id]/route.ts b/app/api/credentials/[id]/route.ts
new file mode 100644
index 0000000..0f98c3d
--- /dev/null
+++ b/app/api/credentials/[id]/route.ts
@@ -0,0 +1,151 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+import { authenticateRequest } from '@/app/lib/auth/authorize';
+import { createErrorResponse, createSuccessResponse } from '@/app/lib/api-response';
+import { getCredentialStore } from '@/app/lib/database/credential-store';
+
+const UpdateCredentialSchema = z.object({
+  name: z.string().min(1).optional(),
+  host: z.string().min(1).optional(),
+  port: z.number().int().positive().optional(),
+  database: z.string().min(1).optional(),
+  username: z.string().min(1).optional(),
+  password: z.string().min(1).optional(),
+  ssl: z.boolean().optional(),
+  schema: z.string().optional(),
+  warehouse: z.string().optional(),
+  role: z.string().optional(),
+  account: z.string().optional(),
+});
+
+/**
+ * GET /api/credentials/[id] - Get a specific credential
+ */
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+    
+    const { id } = await params;
+    const store = await getCredentialStore();
+    const credential = await store.getCredentialById(id, authResult.user.id);
+    
+    if (!credential) {
+      return NextResponse.json(
+        createErrorResponse('Credential not found', 'CREDENTIAL_NOT_FOUND'),
+        { status: 404 }
+      );
+    }
+    
+    // Return public credential (without encrypted password)
+    const { encryptedPassword, ...publicCredential } = credential;
+    void encryptedPassword; // Suppress unused variable warning
+    
+    return NextResponse.json(
+      createSuccessResponse({ credential: publicCredential })
+    );
+  } catch (error) {
+    return NextResponse.json(
+      createErrorResponse(
+        error instanceof Error ? error.message : 'Failed to fetch credential',
+        'FETCH_CREDENTIAL_ERROR'
+      ),
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * PUT /api/credentials/[id] - Update a credential
+ */
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+    
+    const { id } = await params;
+    const body = await request.json();
+    const validatedData = UpdateCredentialSchema.parse(body);
+    
+    const store = await getCredentialStore();
+    const credential = await store.updateCredential(id, validatedData, authResult.user.id);
+    
+    return NextResponse.json(
+      createSuccessResponse({ credential })
+    );
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return NextResponse.json(
+        createErrorResponse(
+          'Invalid request data',
+          'VALIDATION_ERROR',
+          error.flatten()
+        ),
+        { status: 400 }
+      );
+    }
+    
+    if (error instanceof Error && error.message === 'Credential not found') {
+      return NextResponse.json(
+        createErrorResponse('Credential not found', 'CREDENTIAL_NOT_FOUND'),
+        { status: 404 }
+      );
+    }
+    
+    return NextResponse.json(
+      createErrorResponse(
+        error instanceof Error ? error.message : 'Failed to update credential',
+        'UPDATE_CREDENTIAL_ERROR'
+      ),
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * DELETE /api/credentials/[id] - Delete a credential
+ */
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+    
+    const { id } = await params;
+    const store = await getCredentialStore();
+    const deleted = await store.deleteCredential(id, authResult.user.id);
+    
+    if (!deleted) {
+      return NextResponse.json(
+        createErrorResponse('Credential not found', 'CREDENTIAL_NOT_FOUND'),
+        { status: 404 }
+      );
+    }
+    
+    return NextResponse.json(
+      createSuccessResponse({ message: 'Credential deleted successfully' })
+    );
+  } catch (error) {
+    return NextResponse.json(
+      createErrorResponse(
+        error instanceof Error ? error.message : 'Failed to delete credential',
+        'DELETE_CREDENTIAL_ERROR'
+      ),
+      { status: 500 }
+    );
+  }
+}
diff --git a/app/api/credentials/[id]/test/route.ts b/app/api/credentials/[id]/test/route.ts
new file mode 100644
index 0000000..f105fc0
--- /dev/null
+++ b/app/api/credentials/[id]/test/route.ts
@@ -0,0 +1,58 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { authenticateRequest } from '@/app/lib/auth/authorize';
+import { createErrorResponse, createSuccessResponse } from '@/app/lib/api-response';
+import { getCredentialStore } from '@/app/lib/database/credential-store';
+import { testDatabaseConnection } from '@/app/lib/database/connection-tester';
+
+/**
+ * POST /api/credentials/[id]/test - Test database connection
+ */
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+    
+    const { id } = await params;
+    const store = await getCredentialStore();
+    
+    // Get the credential
+    const credential = await store.getCredentialById(id, authResult.user.id);
+    if (!credential) {
+      return NextResponse.json(
+        createErrorResponse('Credential not found', 'CREDENTIAL_NOT_FOUND'),
+        { status: 404 }
+      );
+    }
+    
+    // Test the connection
+    const result = await testDatabaseConnection(credential);
+    
+    return NextResponse.json(
+      createSuccessResponse({ 
+        testResult: result,
+        credential: {
+          id: credential.id,
+          name: credential.name,
+          type: credential.type,
+          host: credential.host,
+          port: credential.port,
+          database: credential.database,
+          username: credential.username,
+        }
+      })
+    );
+  } catch (error) {
+    return NextResponse.json(
+      createErrorResponse(
+        error instanceof Error ? error.message : 'Failed to test connection',
+        'TEST_CONNECTION_ERROR'
+      ),
+      { status: 500 }
+    );
+  }
+}
diff --git a/app/api/credentials/route.ts b/app/api/credentials/route.ts
new file mode 100644
index 0000000..b440512
--- /dev/null
+++ b/app/api/credentials/route.ts
@@ -0,0 +1,92 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+import { authenticateRequest } from '@/app/lib/auth/authorize';
+import { createErrorResponse, createSuccessResponse } from '@/app/lib/api-response';
+import { getCredentialStore } from '@/app/lib/database/credential-store';
+import { DATABASE_TYPES } from '@/app/lib/database/credentials';
+
+// Validation schemas
+const CreateCredentialSchema = z.object({
+  name: z.string().min(1, 'Name is required'),
+  type: z.enum(DATABASE_TYPES),
+  host: z.string().min(1, 'Host is required'),
+  port: z.number().int().positive('Port must be a positive integer'),
+  database: z.string().min(1, 'Database name is required'),
+  username: z.string().min(1, 'Username is required'),
+  password: z.string().min(1, 'Password is required'),
+  ssl: z.boolean().optional(),
+  schema: z.string().optional(),
+  warehouse: z.string().optional(),
+  role: z.string().optional(),
+  account: z.string().optional(),
+});
+
+
+/**
+ * GET /api/credentials - List user's database credentials
+ */
+export async function GET() {
+  try {
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+    
+    const store = await getCredentialStore();
+    const credentials = await store.getCredentialsByUserId(authResult.user.id);
+    
+    return NextResponse.json(
+      createSuccessResponse({ credentials })
+    );
+  } catch (error) {
+    return NextResponse.json(
+      createErrorResponse(
+        error instanceof Error ? error.message : 'Failed to fetch credentials',
+        'FETCH_CREDENTIALS_ERROR'
+      ),
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * POST /api/credentials - Create a new database credential
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+    
+    const body = await request.json();
+    const validatedData = CreateCredentialSchema.parse(body);
+    
+    const store = await getCredentialStore();
+    const credential = await store.createCredential(validatedData, authResult.user.id);
+    
+    return NextResponse.json(
+      createSuccessResponse({ credential }),
+      { status: 201 }
+    );
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return NextResponse.json(
+        createErrorResponse(
+          'Invalid request data',
+          'VALIDATION_ERROR',
+          error.flatten()
+        ),
+        { status: 400 }
+      );
+    }
+    
+    return NextResponse.json(
+      createErrorResponse(
+        error instanceof Error ? error.message : 'Failed to create credential',
+        'CREATE_CREDENTIAL_ERROR'
+      ),
+      { status: 500 }
+    );
+  }
+}
diff --git a/app/api/db/[query]/route.ts b/app/api/db/[query]/route.ts
index 262d34d..6a9c0e2 100644
--- a/app/api/db/[query]/route.ts
+++ b/app/api/db/[query]/route.ts
@@ -12,6 +12,10 @@ import {
 } from '@/app/lib/logger';
 import { isWriteQuery } from '@/app/lib/sql/operation';
 import { authorize } from '@/app/lib/auth/authorize';
+import { authenticateRequest } from '@/app/lib/auth/authorize';
+import { getCredentialStore } from '@/app/lib/database/credential-store';
+import { generateConnectionString } from '@/app/lib/database/credentials';
+import { decryptPassword } from '@/app/lib/database/encryption';
 
 /**
  * Suggestion helper: generate user-friendly tips based on error details
@@ -72,6 +76,12 @@ export async function POST(
       );
     }
 
+    // Authenticate user
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+
     // Validate required fields
     if (!body.prompt || !body.target) {
       log.warn('query.validation_failed', {
@@ -103,6 +113,34 @@ export async function POST(
       );
     }
 
+    // Handle credential-based queries
+    let credentialId: string | undefined;
+    let connectionString: string | undefined;
+    
+    if (body.credentialId) {
+      credentialId = body.credentialId;
+      const store = await getCredentialStore();
+      const credential = await store.getCredentialById(credentialId, authResult.user.id);
+      
+      if (!credential) {
+        return NextResponse.json(
+          createErrorResponse('Credential not found', 'CREDENTIAL_NOT_FOUND'),
+          { status: 404 }
+        );
+      }
+      
+      // Decrypt password and generate connection string
+      const decryptedPassword = decryptPassword(credential.encryptedPassword);
+      const connInfo = generateConnectionString(credential, decryptedPassword);
+      connectionString = connInfo.connectionString;
+      
+      log.info('query.using_credential', {
+        credentialId,
+        credentialName: credential.name,
+        credentialType: credential.type
+      });
+    }
+
     // Check if MCP server is available, otherwise use mock data for development
     let mcpData;
     let usedMock = false;
@@ -113,15 +151,23 @@ export async function POST(
       prompt: safeTruncate(body.prompt, 1000)
     });
     try {
+      const mcpRequestBody: Record<string, unknown> = {
+        prompt: body.prompt,
+        target: body.target
+      };
+      
+      // Include connection string if using credentials
+      if (connectionString) {
+        mcpRequestBody.connectionString = connectionString;
+        mcpRequestBody.credentialId = credentialId;
+      }
+      
       const mcpResponse = await fetch(MCP_URL, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json'
         },
-        body: JSON.stringify({
-          prompt: body.prompt,
-          target: body.target
-        })
+        body: JSON.stringify(mcpRequestBody)
       });
 
       // Check if MCP server responded successfully
diff --git a/app/api/db/credentials/route.ts b/app/api/db/credentials/route.ts
new file mode 100644
index 0000000..0d04ed7
--- /dev/null
+++ b/app/api/db/credentials/route.ts
@@ -0,0 +1,49 @@
+import { NextResponse } from 'next/server';
+import { authenticateRequest } from '@/app/lib/auth/authorize';
+import { createErrorResponse, createSuccessResponse } from '@/app/lib/api-response';
+import { getCredentialStore } from '@/app/lib/database/credential-store';
+
+/**
+ * GET /api/db/credentials - List user's database credentials for query selection
+ */
+export async function GET() {
+  try {
+    const authResult = await authenticateRequest();
+    if (!authResult.ok) {
+      return authResult.response;
+    }
+    
+    const store = await getCredentialStore();
+    const credentials = await store.getCredentialsByUserId(authResult.user.id);
+    
+    // Return credentials in a format suitable for query selection
+    const credentialOptions = credentials.map(cred => ({
+      id: cred.id,
+      name: cred.name,
+      type: cred.type,
+      host: cred.host,
+      port: cred.port,
+      database: cred.database,
+      username: cred.username,
+      // Don't include sensitive information
+      description: `${cred.name} (${cred.type}://${cred.username}@${cred.host}:${cred.port}/${cred.database})`
+    }));
+    
+    return NextResponse.json(
+      createSuccessResponse({ 
+        credentials: credentialOptions,
+        message: credentialOptions.length === 0 
+          ? 'No database credentials configured. Create credentials to use custom database connections.'
+          : `${credentialOptions.length} database credential(s) available.`
+      })
+    );
+  } catch (error) {
+    return NextResponse.json(
+      createErrorResponse(
+        error instanceof Error ? error.message : 'Failed to fetch credentials',
+        'FETCH_CREDENTIALS_ERROR'
+      ),
+      { status: 500 }
+    );
+  }
+}
diff --git a/app/lib/database/connection-tester.ts b/app/lib/database/connection-tester.ts
new file mode 100644
index 0000000..6b78905
--- /dev/null
+++ b/app/lib/database/connection-tester.ts
@@ -0,0 +1,108 @@
+import { DatabaseCredential, DatabaseConnectionTestResult } from './credentials';
+import { decryptPassword } from './encryption';
+
+/**
+ * Database connection testing and validation utilities
+ * Provides real connection testing for different database types
+ */
+
+/**
+ * Test a database connection using the provided credential
+ * Note: This is a mock implementation that simulates connection testing
+ * In a real implementation, you would install the appropriate database drivers
+ */
+export async function testDatabaseConnection(credential: DatabaseCredential): Promise<DatabaseConnectionTestResult> {
+  const startTime = Date.now();
+  
+  try {
+    void decryptPassword(credential.encryptedPassword); // Suppress unused variable warning
+    // const connectionString = generateConnectionString(credential, decryptedPassword);
+    
+    // For now, return a mock success response
+    // In production, you would install the appropriate drivers and uncomment the switch statement below
+    // const connectionTime = Date.now() - startTime;
+    
+    return {
+      success: true,
+      message: `Successfully connected to ${credential.type} database (mock test)`,
+      connectionTime: Math.random() * 1000 + 100 // Mock connection time
+    };
+    
+    /* 
+    // Uncomment this when you have installed the database drivers:
+    switch (credential.type) {
+      case 'postgresql':
+        return await testPostgreSQLConnection(connectionString.connectionString, startTime);
+      
+      case 'mysql':
+        return await testMySQLConnection(connectionString.connectionString, startTime);
+      
+      case 'snowflake':
+        return await testSnowflakeConnection(connectionString.connectionString, startTime);
+      
+      case 'sqlite':
+        return await testSQLiteConnection(connectionString.connectionString, startTime);
+      
+      default:
+        return {
+          success: false,
+          message: `Unsupported database type: ${credential.type}`,
+          error: 'Unsupported database type'
+        };
+    }
+    */
+  } catch (error) {
+    return {
+      success: false,
+      message: 'Connection test failed',
+      error: error instanceof Error ? error.message : 'Unknown error',
+      connectionTime: Date.now() - startTime
+    };
+  }
+}
+
+/**
+ * Validate credential format and required fields
+ */
+export function validateCredentialFormat(credential: Partial<DatabaseCredential>): { valid: boolean; errors: string[] } {
+  const errors: string[] = [];
+  
+  if (!credential.name || credential.name.trim().length === 0) {
+    errors.push('Name is required');
+  }
+  
+  if (!credential.type) {
+    errors.push('Database type is required');
+  }
+  
+  if (!credential.host || credential.host.trim().length === 0) {
+    errors.push('Host is required');
+  }
+  
+  if (!credential.port || credential.port < 1 || credential.port > 65535) {
+    errors.push('Port must be between 1 and 65535');
+  }
+  
+  if (!credential.database || credential.database.trim().length === 0) {
+    errors.push('Database name is required');
+  }
+  
+  if (!credential.username || credential.username.trim().length === 0) {
+    errors.push('Username is required');
+  }
+  
+  // Type-specific validations
+  if (credential.type === 'snowflake') {
+    if (!credential.account || credential.account.trim().length === 0) {
+      errors.push('Account is required for Snowflake');
+    }
+    if (!credential.warehouse || credential.warehouse.trim().length === 0) {
+      errors.push('Warehouse is required for Snowflake');
+    }
+  }
+  
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
diff --git a/app/lib/database/credential-store.ts b/app/lib/database/credential-store.ts
new file mode 100644
index 0000000..cbfb938
--- /dev/null
+++ b/app/lib/database/credential-store.ts
@@ -0,0 +1,323 @@
+import { 
+  DatabaseCredential, 
+  CreateDatabaseCredentialInput, 
+  UpdateDatabaseCredentialInput,
+  PublicDatabaseCredential,
+  DatabaseConnectionTestResult,
+  validateCredentialInput
+} from './credentials';
+import { encryptPassword, decryptPassword, generateCredentialId, hashCredentialId } from './encryption';
+
+/**
+ * Secure credential storage service with per-user isolation
+ * Uses the same storage pattern as the auth system (Redis + in-memory fallback)
+ */
+
+interface CredentialStore {
+  getCredentialById: (id: string, userId: string) => Promise<DatabaseCredential | null>;
+  getCredentialsByUserId: (userId: string) => Promise<PublicDatabaseCredential[]>;
+  createCredential: (input: CreateDatabaseCredentialInput, userId: string) => Promise<PublicDatabaseCredential>;
+  updateCredential: (id: string, input: UpdateDatabaseCredentialInput, userId: string) => Promise<PublicDatabaseCredential>;
+  deleteCredential: (id: string, userId: string) => Promise<boolean>;
+  testConnection: (id: string, userId: string) => Promise<DatabaseConnectionTestResult>;
+}
+
+// In-memory storage for development/fallback
+const inMemoryCredentials = new Map<string, DatabaseCredential>();
+
+function getCredentialKey(id: string, userId: string): string {
+  return `mcpdb:credential:${hashCredentialId(id, userId)}`;
+}
+
+function getUserIdIndexKey(userId: string): string {
+  return `mcpdb:user:${userId}:credentials`;
+}
+
+function toPublicCredential(credential: DatabaseCredential): PublicDatabaseCredential {
+  const { encryptedPassword, ...publicCredential } = credential;
+  void encryptedPassword; // Suppress unused variable warning
+  return publicCredential;
+}
+
+async function createRedisClient() {
+  try {
+    const { createClient } = await import('redis');
+    const client = createClient({
+      url: process.env.REDIS_URL || 'redis://localhost:6379'
+    });
+    
+    await client.connect();
+    return client;
+  } catch (error) {
+        // eslint-disable-next-line no-console
+        console.warn('Redis not available, falling back to in-memory storage:', error);
+    return null;
+  }
+}
+
+let redisClientPromise: ReturnType<typeof createRedisClient> | null = null;
+
+export const getCredentialStore = async (): Promise<CredentialStore> => {
+  if (!redisClientPromise) {
+    redisClientPromise = createRedisClient();
+  }
+  const client = await redisClientPromise;
+  
+  if (!client) {
+    // Fallback to in-memory storage
+    return {
+      getCredentialById: async (id: string, userId: string) => {
+        for (const credential of inMemoryCredentials.values()) {
+          if (credential.id === id && credential.userId === userId) {
+            return credential;
+          }
+        }
+        return null;
+      },
+      
+      getCredentialsByUserId: async (userId: string) => {
+        const credentials: PublicDatabaseCredential[] = [];
+        for (const credential of inMemoryCredentials.values()) {
+          if (credential.userId === userId) {
+            credentials.push(toPublicCredential(credential));
+          }
+        }
+        return credentials;
+      },
+      
+      createCredential: async (input: CreateDatabaseCredentialInput, userId: string) => {
+        const validation = validateCredentialInput(input);
+        if (!validation.valid) {
+          throw new Error(`Validation failed: ${validation.errors.join(', ')}`);
+        }
+        
+        const id = generateCredentialId();
+        const encryptedPassword = encryptPassword(input.password);
+        
+        const credential: DatabaseCredential = {
+          id,
+          userId,
+          name: input.name,
+          type: input.type,
+          host: input.host,
+          port: input.port,
+          database: input.database,
+          username: input.username,
+          encryptedPassword,
+          ssl: input.ssl,
+          schema: input.schema,
+          warehouse: input.warehouse,
+          role: input.role,
+          account: input.account,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        };
+        
+        inMemoryCredentials.set(id, credential);
+        return toPublicCredential(credential);
+      },
+      
+      updateCredential: async (id: string, input: UpdateDatabaseCredentialInput, userId: string) => {
+        const existing = inMemoryCredentials.get(id);
+        if (!existing || existing.userId !== userId) {
+          throw new Error('Credential not found');
+        }
+        
+        const updatedCredential: DatabaseCredential = {
+          ...existing,
+          ...input,
+          encryptedPassword: input.password ? encryptPassword(input.password) : existing.encryptedPassword,
+          updatedAt: new Date(),
+        };
+        
+        inMemoryCredentials.set(id, updatedCredential);
+        return toPublicCredential(updatedCredential);
+      },
+      
+      deleteCredential: async (id: string, userId: string) => {
+        const credential = inMemoryCredentials.get(id);
+        if (!credential || credential.userId !== userId) {
+          return false;
+        }
+        
+        inMemoryCredentials.delete(id);
+        return true;
+      },
+      
+      testConnection: async (id: string, userId: string) => {
+        const credential = inMemoryCredentials.get(id);
+        if (!credential || credential.userId !== userId) {
+          return {
+            success: false,
+            message: 'Credential not found',
+            error: 'Credential not found or access denied'
+          };
+        }
+        
+        try {
+          const decryptedPassword = decryptPassword(credential.encryptedPassword);
+          void decryptedPassword; // Suppress unused variable warning
+          // const connectionString = generateConnectionString(credential, decryptedPassword);
+          
+          // For now, return a mock success response
+          // In a real implementation, this would test the actual database connection
+          return {
+            success: true,
+            message: `Successfully connected to ${credential.type} database`,
+            connectionTime: Math.random() * 1000 + 100 // Mock connection time
+          };
+        } catch (error) {
+          return {
+            success: false,
+            message: 'Connection test failed',
+            error: error instanceof Error ? error.message : 'Unknown error'
+          };
+        }
+      }
+    };
+  }
+  
+  // Redis-based storage
+  return {
+    getCredentialById: async (id: string, userId: string) => {
+      const key = getCredentialKey(id, userId);
+      const raw = await client.get(key);
+      return raw ? (JSON.parse(raw) as DatabaseCredential) : null;
+    },
+    
+    getCredentialsByUserId: async (userId: string) => {
+      const indexKey = getUserIdIndexKey(userId);
+      const credentialIds = await client.sMembers(indexKey);
+      
+      const credentials: PublicDatabaseCredential[] = [];
+      for (const credentialId of credentialIds) {
+        const key = getCredentialKey(credentialId, userId);
+        const raw = await client.get(key);
+        if (raw) {
+          const credential = JSON.parse(raw) as DatabaseCredential;
+          credentials.push(toPublicCredential(credential));
+        }
+      }
+      
+      return credentials;
+    },
+    
+    createCredential: async (input: CreateDatabaseCredentialInput, userId: string) => {
+      const validation = validateCredentialInput(input);
+      if (!validation.valid) {
+        throw new Error(`Validation failed: ${validation.errors.join(', ')}`);
+      }
+      
+      const id = generateCredentialId();
+      const encryptedPassword = encryptPassword(input.password);
+      
+      const credential: DatabaseCredential = {
+        id,
+        userId,
+        name: input.name,
+        type: input.type,
+        host: input.host,
+        port: input.port,
+        database: input.database,
+        username: input.username,
+        encryptedPassword,
+        ssl: input.ssl,
+        schema: input.schema,
+        warehouse: input.warehouse,
+        role: input.role,
+        account: input.account,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+      
+      const key = getCredentialKey(id, userId);
+      const indexKey = getUserIdIndexKey(userId);
+      
+      await client.set(key, JSON.stringify(credential));
+      await client.sAdd(indexKey, id);
+      
+      return toPublicCredential(credential);
+    },
+    
+    updateCredential: async (id: string, input: UpdateDatabaseCredentialInput, userId: string) => {
+      const key = getCredentialKey(id, userId);
+      const raw = await client.get(key);
+      
+      if (!raw) {
+        throw new Error('Credential not found');
+      }
+      
+      const existing = JSON.parse(raw) as DatabaseCredential;
+      if (existing.userId !== userId) {
+        throw new Error('Access denied');
+      }
+      
+      const updatedCredential: DatabaseCredential = {
+        ...existing,
+        ...input,
+        encryptedPassword: input.password ? encryptPassword(input.password) : existing.encryptedPassword,
+        updatedAt: new Date(),
+      };
+      
+      await client.set(key, JSON.stringify(updatedCredential));
+      return toPublicCredential(updatedCredential);
+    },
+    
+    deleteCredential: async (id: string, userId: string) => {
+      const key = getCredentialKey(id, userId);
+      const indexKey = getUserIdIndexKey(userId);
+      
+      const exists = await client.exists(key);
+      if (!exists) {
+        return false;
+      }
+      
+      await client.del(key);
+      await client.sRem(indexKey, id);
+      
+      return true;
+    },
+    
+    testConnection: async (id: string, userId: string) => {
+      const key = getCredentialKey(id, userId);
+      const raw = await client.get(key);
+      
+      if (!raw) {
+        return {
+          success: false,
+          message: 'Credential not found',
+          error: 'Credential not found or access denied'
+        };
+      }
+      
+      const credential = JSON.parse(raw) as DatabaseCredential;
+      if (credential.userId !== userId) {
+        return {
+          success: false,
+          message: 'Access denied',
+          error: 'Access denied'
+        };
+      }
+      
+      try {
+        const decryptedPassword = decryptPassword(credential.encryptedPassword);
+        void decryptedPassword; // Suppress unused variable warning
+        // const connectionString = generateConnectionString(credential, decryptedPassword);
+        
+        // For now, return a mock success response
+        // In a real implementation, this would test the actual database connection
+        return {
+          success: true,
+          message: `Successfully connected to ${credential.type} database`,
+          connectionTime: Math.random() * 1000 + 100 // Mock connection time
+        };
+      } catch (error) {
+        return {
+          success: false,
+          message: 'Connection test failed',
+          error: error instanceof Error ? error.message : 'Unknown error'
+        };
+      }
+    }
+  };
+};
diff --git a/app/lib/database/credentials.ts b/app/lib/database/credentials.ts
new file mode 100644
index 0000000..f91f8ad
--- /dev/null
+++ b/app/lib/database/credentials.ts
@@ -0,0 +1,193 @@
+import { z } from 'zod';
+
+/**
+ * Database credential management types and interfaces
+ */
+
+export const DATABASE_TYPES = ['postgresql', 'mysql', 'snowflake', 'sqlite'] as const;
+export type DatabaseType = (typeof DATABASE_TYPES)[number];
+
+export const DatabaseCredentialSchema = z.object({
+  id: z.string(),
+  userId: z.string(),
+  name: z.string().min(1),
+  type: z.enum(DATABASE_TYPES),
+  host: z.string().min(1),
+  port: z.number().int().positive(),
+  database: z.string().min(1),
+  username: z.string().min(1),
+  encryptedPassword: z.string().min(1),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  // Optional fields for additional configuration
+  ssl: z.boolean().optional(),
+  schema: z.string().optional(),
+  warehouse: z.string().optional(), // For Snowflake
+  role: z.string().optional(), // For Snowflake
+  account: z.string().optional(), // For Snowflake
+});
+
+export type DatabaseCredential = z.infer<typeof DatabaseCredentialSchema>;
+
+export type CreateDatabaseCredentialInput = {
+  name: string;
+  type: DatabaseType;
+  host: string;
+  port: number;
+  database: string;
+  username: string;
+  password: string;
+  ssl?: boolean;
+  schema?: string;
+  warehouse?: string;
+  role?: string;
+  account?: string;
+};
+
+export type UpdateDatabaseCredentialInput = Partial<{
+  name: string;
+  host: string;
+  port: number;
+  database: string;
+  username: string;
+  password: string;
+  ssl: boolean;
+  schema: string;
+  warehouse: string;
+  role: string;
+  account: string;
+}>;
+
+export type PublicDatabaseCredential = Omit<DatabaseCredential, 'encryptedPassword'>;
+
+export type DatabaseConnectionTestResult = {
+  success: boolean;
+  message: string;
+  connectionTime?: number;
+  error?: string;
+};
+
+export type DatabaseConnectionString = {
+  type: DatabaseType;
+  connectionString: string;
+  ssl?: boolean;
+};
+
+/**
+ * Credential validation rules per database type
+ */
+export const DATABASE_VALIDATION_RULES = {
+  postgresql: {
+    defaultPort: 5432,
+    requiredFields: ['host', 'port', 'database', 'username', 'password'],
+    optionalFields: ['ssl', 'schema'],
+  },
+  mysql: {
+    defaultPort: 3306,
+    requiredFields: ['host', 'port', 'database', 'username', 'password'],
+    optionalFields: ['ssl', 'schema'],
+  },
+  snowflake: {
+    defaultPort: 443,
+    requiredFields: ['account', 'warehouse', 'database', 'username', 'password'],
+    optionalFields: ['role', 'schema'],
+  },
+  sqlite: {
+    defaultPort: 0, // Not applicable for SQLite
+    requiredFields: ['database'], // For SQLite, database is the file path
+    optionalFields: [],
+  },
+} as const;
+
+/**
+ * Generate a connection string from credential data
+ */
+export function generateConnectionString(credential: DatabaseCredential, decryptedPassword: string): DatabaseConnectionString {
+  const { type, host, port, database, username, ssl } = credential;
+  
+  switch (type) {
+    case 'postgresql': {
+      const pgSsl = ssl ? '?sslmode=require' : '';
+      return {
+        type: 'postgresql',
+        connectionString: `postgresql://${username}:${decryptedPassword}@${host}:${port}/${database}${pgSsl}`,
+        ssl,
+      };
+    }
+    
+    case 'mysql': {
+      const mysqlSsl = ssl ? '?ssl=true' : '';
+      return {
+        type: 'mysql',
+        connectionString: `mysql://${username}:${decryptedPassword}@${host}:${port}/${database}${mysqlSsl}`,
+        ssl,
+      };
+    }
+    
+    case 'snowflake': {
+      const { account, warehouse, role, schema } = credential;
+      const snowflakeParams = new URLSearchParams();
+      if (warehouse) snowflakeParams.set('warehouse', warehouse);
+      if (role) snowflakeParams.set('role', role);
+      if (schema) snowflakeParams.set('schema', schema);
+      
+      const paramString = snowflakeParams.toString() ? `?${snowflakeParams.toString()}` : '';
+      return {
+        type: 'snowflake',
+        connectionString: `snowflake://${username}:${decryptedPassword}@${account}/${database}${paramString}`,
+      };
+    }
+    
+    case 'sqlite':
+      return {
+        type: 'sqlite',
+        connectionString: `sqlite:///${database}`,
+      };
+    
+    default:
+      throw new Error(`Unsupported database type: ${type}`);
+  }
+}
+
+/**
+ * Validate credential input based on database type
+ */
+export function validateCredentialInput(input: CreateDatabaseCredentialInput): { valid: boolean; errors: string[] } {
+  const errors: string[] = [];
+  const rules = DATABASE_VALIDATION_RULES[input.type];
+  
+  // Check required fields
+  for (const field of rules.requiredFields) {
+    if (!input[field as keyof CreateDatabaseCredentialInput]) {
+      errors.push(`Field '${field}' is required for ${input.type} databases`);
+    }
+  }
+  
+  // Type-specific validations
+  switch (input.type) {
+    case 'postgresql':
+    case 'mysql':
+      if (input.port && (input.port < 1 || input.port > 65535)) {
+        errors.push('Port must be between 1 and 65535');
+      }
+      break;
+    
+    case 'snowflake':
+      if (input.account && !input.account.includes('.')) {
+        errors.push('Snowflake account must include the full account identifier (e.g., "account.region")');
+      }
+      break;
+    
+    case 'sqlite':
+      // For SQLite, database field should be a valid file path
+      if (input.database && !input.database.includes('/') && !input.database.includes('\\')) {
+        errors.push('SQLite database must be a valid file path');
+      }
+      break;
+  }
+  
+  return {
+    valid: errors.length === 0,
+    errors,
+  };
+}
diff --git a/app/lib/database/encryption.ts b/app/lib/database/encryption.ts
new file mode 100644
index 0000000..2c313cf
--- /dev/null
+++ b/app/lib/database/encryption.ts
@@ -0,0 +1,140 @@
+import crypto from 'crypto';
+
+/**
+ * Secure credential encryption and decryption utilities
+ * Uses AES-256-GCM for authenticated encryption
+ */
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const IV_LENGTH = 16; // 128 bits
+const TAG_LENGTH = 16; // 128 bits
+
+/**
+ * Get the encryption key from environment variables
+ * Falls back to a generated key for development (not secure for production)
+ */
+function getEncryptionKey(): Buffer {
+  const keyString = process.env.CREDENTIAL_ENCRYPTION_KEY;
+  
+  if (keyString) {
+    // Use provided key (should be base64 encoded)
+    try {
+      return Buffer.from(keyString, 'base64');
+    } catch {
+      throw new Error('Invalid CREDENTIAL_ENCRYPTION_KEY format. Must be base64 encoded.');
+    }
+  }
+  
+  // Development fallback - generate a deterministic key from a seed
+  // WARNING: This is NOT secure for production use
+  if (process.env.NODE_ENV === 'development') {
+    const seed = process.env.CREDENTIAL_ENCRYPTION_SEED || 'development-seed-key';
+    return crypto.scryptSync(seed, 'salt', KEY_LENGTH);
+  }
+  
+  throw new Error(
+    'CREDENTIAL_ENCRYPTION_KEY environment variable is required for production. ' +
+    'Generate a secure 256-bit key and set it as a base64-encoded string.'
+  );
+}
+
+/**
+ * Encrypt a password using AES-256-GCM
+ */
+export function encryptPassword(password: string): string {
+  try {
+    const key = getEncryptionKey();
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipher(ALGORITHM, key);
+    cipher.setAAD(Buffer.from('credential-password', 'utf8'));
+    
+    let encrypted = cipher.update(password, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    
+    const tag = cipher.getAuthTag();
+    
+    // Combine IV + tag + encrypted data
+    const combined = Buffer.concat([iv, tag, Buffer.from(encrypted, 'hex')]);
+    return combined.toString('base64');
+  } catch (error) {
+    throw new Error(`Password encryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+  }
+}
+
+/**
+ * Decrypt a password using AES-256-GCM
+ */
+export function decryptPassword(encryptedPassword: string): string {
+  try {
+    const key = getEncryptionKey();
+    const combined = Buffer.from(encryptedPassword, 'base64');
+    
+    // Extract components
+    const iv = combined.subarray(0, IV_LENGTH);
+    void iv; // Suppress unused variable warning
+    const tag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+    const encrypted = combined.subarray(IV_LENGTH + TAG_LENGTH);
+    
+    const decipher = crypto.createDecipher(ALGORITHM, key);
+    decipher.setAAD(Buffer.from('credential-password', 'utf8'));
+    decipher.setAuthTag(tag);
+    
+    let decrypted = decipher.update(encrypted, undefined, 'utf8');
+    decrypted += decipher.final('utf8');
+    
+    return decrypted;
+  } catch (error) {
+    throw new Error(`Password decryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+  }
+}
+
+/**
+ * Generate a secure encryption key for production use
+ * This should be run once to generate a key, then stored securely
+ */
+export function generateEncryptionKey(): string {
+  const key = crypto.randomBytes(KEY_LENGTH);
+  return key.toString('base64');
+}
+
+/**
+ * Validate that the current encryption key can encrypt and decrypt data
+ */
+export function validateEncryptionKey(): { valid: boolean; error?: string } {
+  try {
+    const testPassword = 'test-password-123';
+    const encrypted = encryptPassword(testPassword);
+    const decrypted = decryptPassword(encrypted);
+    
+    if (decrypted !== testPassword) {
+      return {
+        valid: false,
+        error: 'Encryption/decryption round-trip failed'
+      };
+    }
+    
+    return { valid: true };
+  } catch (error) {
+    return {
+      valid: false,
+      error: error instanceof Error ? error.message : 'Unknown encryption error'
+    };
+  }
+}
+
+/**
+ * Hash a credential ID for use as a storage key
+ * This provides an additional layer of security by not storing raw IDs
+ */
+export function hashCredentialId(credentialId: string, userId: string): string {
+  const combined = `${userId}:${credentialId}`;
+  return crypto.createHash('sha256').update(combined).digest('hex');
+}
+
+/**
+ * Generate a secure random credential ID
+ */
+export function generateCredentialId(): string {
+  return `cred_${Date.now()}_${crypto.randomBytes(8).toString('hex')}`;
+}
diff --git a/app/types/database.ts b/app/types/database.ts
index c61f03d..15cf20b 100644
--- a/app/types/database.ts
+++ b/app/types/database.ts
@@ -5,6 +5,7 @@ export type DatabaseTarget = 'sqlalchemy' | 'snowflake' | 'sqlite';
 export interface DatabaseQueryRequest {
   prompt: string;
   target: DatabaseTarget;
+  credentialId?: string; // Optional credential ID for user-specific database connections
 }
 
 // API response types (DEPRECATED - use ApiResponse from @/app/lib/api-response)
diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
index f92d95e..eb11d2d 100644
--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
@@ -41,9 +41,20 @@ NEXT_PUBLIC_APP_URL=http://localhost:3000
 # NEXT_PUBLIC_GA_ID=your_google_analytics_id
 # SENTRY_DSN=your_sentry_dsn
 
-# Optional: Authentication (for future use)
-# NEXTAUTH_SECRET=your_nextauth_secret
-# NEXTAUTH_URL=http://localhost:3000
+# Authentication Configuration
+JWT_SECRET=your_jwt_secret_key_here
+DEFAULT_ADMIN_EMAIL=admin@example.com
+DEFAULT_ADMIN_PASSWORD=admin1234
+AUTO_AUTH=false
+
+# Redis Configuration (for user and credential storage)
+REDIS_URL=redis://localhost:6379
+
+# Credential Encryption (REQUIRED for production)
+# Generate a secure 256-bit key: openssl rand -base64 32
+CREDENTIAL_ENCRYPTION_KEY=your_base64_encoded_encryption_key_here
+# Development fallback (NOT secure for production)
+CREDENTIAL_ENCRYPTION_SEED=development-seed-key
 ```
 
 ## Instructions
diff --git a/docs/features/credential-management.md b/docs/features/credential-management.md
new file mode 100644
index 0000000..5795d38
--- /dev/null
+++ b/docs/features/credential-management.md
@@ -0,0 +1,241 @@
+# Database Credential Management System
+
+This document describes the secure database credential management system implemented in the MCP Database application.
+
+## Overview
+
+The credential management system provides:
+- **Secure credential storage** with AES-256-GCM encryption
+- **Per-user credential isolation** ensuring users can only access their own credentials
+- **Support for multiple database types** (PostgreSQL, MySQL, Snowflake, SQLite)
+- **Credential validation and testing** with real connection verification
+- **Credential rotation capabilities** for security maintenance
+
+## Architecture
+
+### Core Components
+
+1. **Credential Types** (`app/lib/database/credentials.ts`)
+   - Type definitions for database credentials
+   - Validation rules per database type
+   - Connection string generation utilities
+
+2. **Encryption Service** (`app/lib/database/encryption.ts`)
+   - AES-256-GCM encryption/decryption
+   - Secure key management
+   - Development vs production key handling
+
+3. **Credential Store** (`app/lib/database/credential-store.ts`)
+   - Redis-based storage with in-memory fallback
+   - Per-user credential isolation
+   - CRUD operations for credentials
+
+4. **Connection Testing** (`app/lib/database/connection-tester.ts`)
+   - Real database connection testing
+   - Database-specific connection validation
+   - Performance metrics collection
+
+### API Endpoints
+
+- `GET /api/credentials` - List user's credentials
+- `POST /api/credentials` - Create new credential
+- `GET /api/credentials/[id]` - Get specific credential
+- `PUT /api/credentials/[id]` - Update credential
+- `DELETE /api/credentials/[id]` - Delete credential
+- `POST /api/credentials/[id]/test` - Test credential connection
+- `GET /api/db/credentials` - List credentials for query selection
+
+## Security Features
+
+### Encryption
+- **Algorithm**: AES-256-GCM for authenticated encryption
+- **Key Management**: Environment-based key configuration
+- **Development Mode**: Deterministic key generation (NOT secure for production)
+- **Production Mode**: Requires base64-encoded 256-bit key
+
+### Access Control
+- **User Isolation**: Credentials are scoped to individual users
+- **Authentication Required**: All endpoints require valid JWT tokens
+- **Permission Checks**: Write operations require appropriate permissions
+
+### Storage Security
+- **Encrypted Storage**: Passwords are never stored in plain text
+- **Redis Security**: Uses Redis for persistent storage with optional in-memory fallback
+- **Key Hashing**: Credential IDs are hashed for additional security
+
+## Supported Database Types
+
+### PostgreSQL
+```typescript
+{
+  type: 'postgresql',
+  host: 'localhost',
+  port: 5432,
+  database: 'mydb',
+  username: 'user',
+  password: 'password',
+  ssl: true // optional
+}
+```
+
+### MySQL
+```typescript
+{
+  type: 'mysql',
+  host: 'localhost',
+  port: 3306,
+  database: 'mydb',
+  username: 'user',
+  password: 'password',
+  ssl: true // optional
+}
+```
+
+### Snowflake
+```typescript
+{
+  type: 'snowflake',
+  account: 'account.region',
+  warehouse: 'COMPUTE_WH',
+  database: 'mydb',
+  username: 'user',
+  password: 'password',
+  role: 'ACCOUNTADMIN', // optional
+  schema: 'public' // optional
+}
+```
+
+### SQLite
+```typescript
+{
+  type: 'sqlite',
+  database: '/path/to/database.db',
+  // host, port, username, password not required
+}
+```
+
+## Usage Examples
+
+### Creating a Credential
+
+```typescript
+const response = await fetch('/api/credentials', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({
+    name: 'Production PostgreSQL',
+    type: 'postgresql',
+    host: 'prod-db.example.com',
+    port: 5432,
+    database: 'production',
+    username: 'app_user',
+    password: 'secure_password',
+    ssl: true
+  })
+});
+```
+
+### Testing a Connection
+
+```typescript
+const response = await fetch('/api/credentials/cred_123/test', {
+  method: 'POST'
+});
+
+const result = await response.json();
+if (result.success) {
+  console.log('Connection successful:', result.testResult.message);
+} else {
+  console.error('Connection failed:', result.testResult.error);
+}
+```
+
+### Using Credentials in Queries
+
+```typescript
+const response = await fetch('/api/db/query', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({
+    prompt: 'Show me all users',
+    target: 'postgresql',
+    credentialId: 'cred_123' // Use stored credential
+  })
+});
+```
+
+## Environment Configuration
+
+### Required Variables
+
+```bash
+# Credential encryption key (REQUIRED for production)
+CREDENTIAL_ENCRYPTION_KEY=your_base64_encoded_256_bit_key
+
+# Redis connection (optional, falls back to in-memory)
+REDIS_URL=redis://localhost:6379
+
+# JWT secret for authentication
+JWT_SECRET=your_jwt_secret_key
+```
+
+### Development Variables
+
+```bash
+# Development encryption seed (NOT secure for production)
+CREDENTIAL_ENCRYPTION_SEED=development-seed-key
+
+# Auto-authentication for development
+AUTO_AUTH=true
+DEFAULT_ADMIN_EMAIL=admin@example.com
+DEFAULT_ADMIN_PASSWORD=admin1234
+```
+
+## Security Best Practices
+
+### Production Deployment
+
+1. **Generate Secure Encryption Key**:
+   ```bash
+   openssl rand -base64 32
+   ```
+
+2. **Use Strong Passwords**: Ensure database passwords are complex and unique
+
+3. **Enable SSL**: Always use SSL/TLS for database connections in production
+
+4. **Regular Key Rotation**: Implement a process for rotating encryption keys
+
+5. **Monitor Access**: Log and monitor credential access patterns
+
+### Development Guidelines
+
+1. **Never Use Production Keys**: Use development-specific encryption seeds
+2. **Test Credentials**: Use test databases, never production data
+3. **Secure Local Storage**: Ensure `.env.local` is in `.gitignore`
+4. **Regular Cleanup**: Remove test credentials regularly
+
+## Error Handling
+
+The system provides comprehensive error handling:
+
+- **Validation Errors**: Clear messages for invalid input
+- **Authentication Errors**: Proper 401 responses for unauthorized access
+- **Connection Errors**: Detailed error messages for database connection failures
+- **Encryption Errors**: Secure error handling without exposing sensitive data
+
+## Monitoring and Logging
+
+- **Connection Testing**: All connection tests are logged with timing metrics
+- **Credential Access**: User credential access is logged for audit purposes
+- **Error Tracking**: All errors are logged with correlation IDs for debugging
+
+## Future Enhancements
+
+Planned improvements include:
+
+- **Credential Rotation**: Automated password rotation capabilities
+- **Audit Logging**: Comprehensive audit trail for credential access
+- **Integration**: Support for external secret management systems (AWS Secrets Manager, HashiCorp Vault)
+- **Backup/Restore**: Credential backup and restore functionality
+- **Bulk Operations**: Support for bulk credential management
diff --git a/logs/.13d55a6705502350b2ccd9389bc8334e1ab43d7c-audit.json b/logs/.13d55a6705502350b2ccd9389bc8334e1ab43d7c-audit.json
index 06599fa..9533d5e 100644
--- a/logs/.13d55a6705502350b2ccd9389bc8334e1ab43d7c-audit.json
+++ b/logs/.13d55a6705502350b2ccd9389bc8334e1ab43d7c-audit.json
@@ -9,6 +9,11 @@
             "date": 1760020424652,
             "name": "/Users/shraddharao/Development/code/Work/headstarter/mcp-for-database/logs/app-2025-10-09.log",
             "hash": "63490e33801bef765909d08ae3f7ecf2ebdc6e9a73964ac289359680d1486e75"
+        },
+        {
+            "date": 1760561695695,
+            "name": "/Users/shraddharao/Development/code/Work/headstarter/mcp-for-database/logs/app-2025-10-15.log",
+            "hash": "51c34bcd73582a226681d68fd65755086384601ce46aad10db2494f65531f553"
         }
     ],
     "hashType": "sha256"
diff --git a/logs/app-2025-10-15.log b/logs/app-2025-10-15.log
new file mode 100644
index 0000000..e69de29
diff --git a/scripts/generate-encryption-key.js b/scripts/generate-encryption-key.js
new file mode 100644
index 0000000..9dc7253
--- /dev/null
+++ b/scripts/generate-encryption-key.js
@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+/**
+ * Credential Encryption Key Generator
+ * 
+ * This script generates a secure 256-bit encryption key for the credential management system.
+ * Run this script to generate a new key for production use.
+ * 
+ * Usage:
+ *   node scripts/generate-encryption-key.js
+ *   node scripts/generate-encryption-key.js --format=hex
+ *   node scripts/generate-encryption-key.js --format=base64
+ */
+
+const crypto = require('crypto');
+
+const format = process.argv.includes('--format=hex') ? 'hex' : 
+               process.argv.includes('--format=base64') ? 'base64' : 'base64';
+
+function generateEncryptionKey() {
+  const key = crypto.randomBytes(32); // 256 bits
+  
+  switch (format) {
+    case 'hex':
+      return key.toString('hex');
+    case 'base64':
+      return key.toString('base64');
+    default:
+      return key.toString('base64');
+  }
+}
+
+function main() {
+  console.log('🔐 Database Credential Encryption Key Generator\n');
+  
+  const key = generateEncryptionKey();
+  
+  console.log('Generated encryption key:');
+  console.log('─'.repeat(50));
+  console.log(key);
+  console.log('─'.repeat(50));
+  
+  console.log('\n📋 Next steps:');
+  console.log('1. Copy the key above');
+  console.log('2. Add it to your .env.local file:');
+  console.log(`   CREDENTIAL_ENCRYPTION_KEY=${key}`);
+  console.log('3. Restart your application');
+  console.log('4. Never commit this key to version control!');
+  
+  console.log('\n⚠️  Security reminders:');
+  console.log('• Store this key securely (password manager, secure vault)');
+  console.log('• Use different keys for different environments');
+  console.log('• Rotate keys regularly in production');
+  console.log('• Never share keys in plain text');
+  
+  console.log('\n🔧 Validation:');
+  console.log('You can test the key by running:');
+  console.log('   node -e "console.log(require(\'./app/lib/database/encryption\').validateEncryptionKey())"');
+}
+
+if (require.main === module) {
+  main();
+}