diff --git a/lib/config/decrypt.js b/lib/config/decrypt.js
index 45a5ff94cce721d8e67d0cffc904e03198b19cb2..1a13820645f9809b4e1bf7a5463a4b173ed96523 100644
--- a/lib/config/decrypt.js
+++ b/lib/config/decrypt.js
@@ -18,13 +18,19 @@ function decryptConfig(
       if (privateKey) {
         for (const encryptedKey of Object.keys(val)) {
           try {
-            decryptedConfig[encryptedKey] = crypto
+            const decryptedStr = crypto
               .privateDecrypt(
                 privateKey,
                 new Buffer(val[encryptedKey], 'base64')
               )
               .toString();
-            logger.debug(`Decrypted ${encryptedKey}`);
+            logger.info(`Decrypted ${encryptedKey}`);
+            if (encryptedKey === 'npmToken') {
+              logger.info('Migrating npmToken to npmrc');
+              decryptedConfig.npmrc = `//registry.npmjs.org/:_authToken=${decryptedStr}\n`;
+            } else {
+              decryptedConfig[encryptedKey] = decryptedStr;
+            }
           } catch (err) {
             logger.warn({ err }, `Error decrypting ${encryptedKey}`);
           }
@@ -47,6 +53,7 @@ function decryptConfig(
     }
   }
   delete decryptedConfig.encrypted;
+  logger.trace({ config: decryptedConfig }, 'decryptedConfig');
   return decryptedConfig;
 }
 
diff --git a/lib/config/massage.js b/lib/config/massage.js
index dd66e438252109bf7bb3cee4c4dae6c763fc10f0..fdc0cae08f28a75862c3405b2ceaa8f481ae1c98 100644
--- a/lib/config/massage.js
+++ b/lib/config/massage.js
@@ -18,7 +18,7 @@ function massageConfig(config) {
     const val = config[key];
     if (allowedStrings.includes(key) && typeof val === 'string') {
       massagedConfig[key] = [val];
-    } else if (key === 'npmToken') {
+    } else if (key === 'npmToken' && val.length < 30) {
       massagedConfig.npmrc = `//registry.npmjs.org/:_authToken=${val}\n`;
       delete massagedConfig.npmToken;
     } else if (isObject(val)) {
diff --git a/lib/config/validation.js b/lib/config/validation.js
index b19b562f258edf43bd8af089443f3981366e86ac..4f233e8425293b7ca7d80b950c8c3cad634f8d07 100644
--- a/lib/config/validation.js
+++ b/lib/config/validation.js
@@ -15,7 +15,7 @@ function validateConfig(config) {
   let warnings = [];
 
   function isIgnored(key) {
-    const ignoredNodes = ['api', 'depType'];
+    const ignoredNodes = ['api', 'depType', 'npmToken'];
     return ignoredNodes.indexOf(key) !== -1;
   }
 
diff --git a/test/config/decrypt.spec.js b/test/config/decrypt.spec.js
index 95508e4b15e54640b193297ea8e4f66d886917c2..456f42bd378a3f79d1f698953a3b41ff72097c6e 100644
--- a/test/config/decrypt.spec.js
+++ b/test/config/decrypt.spec.js
@@ -44,6 +44,8 @@ describe('config/massage', () => {
             encrypted: {
               branchPrefix:
                 'FLA9YHIzpE7YetAg/P0X46npGRCMqn7hgyzwX5ZQ9wYgu9BRRbTiBVsUIFTyM5BuP1Q22slT2GkWvFvum7GU236Y6QiT7Nr8SLvtsJn2XUuq8H7REFKzdy3+wqyyWbCErYTFyY1dcPM7Ht+CaGDWdd8u/FsoX7AdMRs/X1jNUo6iSmlUiyGlYDKF+QMnCJom1VPVgZXWsGKdjI2MLny991QMaiv0VajmFIh4ENv4CtXOl/1twvIl/6XTXAaqpJJKDTPZEuydi+PHDZmal2RAOfrkH4m0UURa7SlfpUlIg+EaqbNGp85hCYXLwRcEET1OnYr3rH1oYkcYJ40any1tvQ==',
+              npmToken:
+                'FLA9YHIzpE7YetAg/P0X46npGRCMqn7hgyzwX5ZQ9wYgu9BRRbTiBVsUIFTyM5BuP1Q22slT2GkWvFvum7GU236Y6QiT7Nr8SLvtsJn2XUuq8H7REFKzdy3+wqyyWbCErYTFyY1dcPM7Ht+CaGDWdd8u/FsoX7AdMRs/X1jNUo6iSmlUiyGlYDKF+QMnCJom1VPVgZXWsGKdjI2MLny991QMaiv0VajmFIh4ENv4CtXOl/1twvIl/6XTXAaqpJJKDTPZEuydi+PHDZmal2RAOfrkH4m0UURa7SlfpUlIg+EaqbNGp85hCYXLwRcEET1OnYr3rH1oYkcYJ40any1tvQ==',
             },
           },
         },
@@ -54,6 +56,10 @@ describe('config/massage', () => {
       expect(res.packageFiles[0].devDependencies.branchPrefix).toEqual(
         'abcdef-ghijklm-nopqf-stuvwxyz'
       );
+      expect(res.packageFiles[0].devDependencies.npmToken).not.toBeDefined();
+      expect(res.packageFiles[0].devDependencies.npmrc).toEqual(
+        '//registry.npmjs.org/:_authToken=abcdef-ghijklm-nopqf-stuvwxyz\n'
+      );
     });
   });
 });