diff --git a/functional-test/src/test/groovy/functional/BasicIntegrationSpec.groovy b/functional-test/src/test/groovy/functional/BasicIntegrationSpec.groovy
index a2a4b7dd..f0100efd 100644
--- a/functional-test/src/test/groovy/functional/BasicIntegrationSpec.groovy
+++ b/functional-test/src/test/groovy/functional/BasicIntegrationSpec.groovy
@@ -138,7 +138,7 @@ class BasicIntegrationSpec extends Specification {
 
     }
 
-    def "test inline playbook encrypt env vars"(){
+    def "test inline playbook encrypt env vars true"(){
         when:
 
         def jobId = "284e1a6e-bae0-4778-a838-50647fb340e3"
@@ -155,6 +155,37 @@ class BasicIntegrationSpec extends Specification {
         Map<String, Integer> ansibleNodeExecutionStatus = TestUtil.getAnsibleNodeResult(logs)
 
 
+        then:
+        executionState!=null
+        executionState.getExecutionState()=="SUCCEEDED"
+        ansibleNodeExecutionStatus.get("ok")!=0
+        ansibleNodeExecutionStatus.get("unreachable")==0
+        ansibleNodeExecutionStatus.get("failed")==0
+        ansibleNodeExecutionStatus.get("skipped")==0
+        ansibleNodeExecutionStatus.get("ignored")==0
+        logs.findAll {it.log.contains("encryptVariable password")}.size() == 1
+        logs.findAll {it.log.contains("encryptVariable username")}.size() == 1
+        logs.findAll {it.log.contains("\"msg\": \"rundeck\"")}.size() == 1
+        logs.findAll {it.log.contains("\"msg\": \"demo\"")}.size() == 1
+
+    }
+    def "test inline playbook encrypt env vars default true"(){
+        when:
+
+        def jobId = "0f714bfb-a0a4-4668-8279-35a8c4167db9"
+
+        JobRun request = new JobRun()
+        request.loglevel = 'DEBUG'
+
+        def result = client.apiCall {api-> api.runJob(jobId, request)}
+        def executionId = result.id
+
+        def executionState = waitForJob(executionId)
+
+        def logs = getLogs(executionId)
+        Map<String, Integer> ansibleNodeExecutionStatus = TestUtil.getAnsibleNodeResult(logs)
+
+
         then:
         executionState!=null
         executionState.getExecutionState()=="SUCCEEDED"
diff --git a/functional-test/src/test/resources/project-import/ansible-test/rundeck-ansible-test/jobs/job-0f714bfb-a0a4-4668-8279-35a8c4167db9.xml b/functional-test/src/test/resources/project-import/ansible-test/rundeck-ansible-test/jobs/job-0f714bfb-a0a4-4668-8279-35a8c4167db9.xml
new file mode 100644
index 00000000..391c1508
--- /dev/null
+++ b/functional-test/src/test/resources/project-import/ansible-test/rundeck-ansible-test/jobs/job-0f714bfb-a0a4-4668-8279-35a8c4167db9.xml
@@ -0,0 +1,49 @@
+<joblist>
+  <job>
+    <context>
+      <options preserveOrder='true'>
+        <option name='password' secure='true' storagePath='keys/project/ansible-test/ssh-node.pass' valueExposed='true' />
+        <option name='username' value='rundeck' />
+      </options>
+    </context>
+    <defaultTab>nodes</defaultTab>
+    <description></description>
+    <dispatch>
+      <excludePrecedence>true</excludePrecedence>
+      <keepgoing>false</keepgoing>
+      <rankOrder>ascending</rankOrder>
+      <successOnEmptyNodeFilter>false</successOnEmptyNodeFilter>
+      <threadcount>1</threadcount>
+    </dispatch>
+    <executionEnabled>true</executionEnabled>
+    <group>Ansible</group>
+    <id>0f714bfb-a0a4-4668-8279-35a8c4167db9</id>
+    <loglevel>INFO</loglevel>
+    <name>simple-inline-playbook-encrypt-vars</name>
+    <nodeFilterEditable>false</nodeFilterEditable>
+    <nodefilters>
+      <filter>name: ssh-node </filter>
+    </nodefilters>
+    <nodesSelectedByDefault>true</nodesSelectedByDefault>
+    <plugins />
+    <scheduleEnabled>true</scheduleEnabled>
+    <sequence keepgoing='false' strategy='node-first'>
+      <command>
+        <node-step-plugin type='com.batix.rundeck.plugins.AnsiblePlaybookInlineWorkflowNodeStep'>
+          <configuration>
+            <entry key='ansible-base-dir-path' value='/home/rundeck/ansible' />
+            <entry key='ansible-become' value='false' />
+            <entry key='ansible-extra-vars' value='password: ${option.password}&#10;username: ${option.username}&#10;test: "demo"' />
+            <entry key='ansible-playbook-inline' value='- hosts: all&#10;  gather_facts: false&#10;  tasks:&#10;&#10;    - name: Get Disk Space&#10;      shell: "df -h"&#10;      register: sh_output&#10;&#10;    - debug: var=sh_output.stdout_lines&#10;    - debug: msg="{{ username }}"&#10;    - debug: msg="{{ test }}" ' />
+            <entry key='ansible-ssh-auth-type' value='privateKey' />
+            <entry key='ansible-ssh-key-storage-path' value='keys/project/ansible-test/ssh-node.key' />
+            <entry key='ansible-ssh-passphrase-option' value='option.password' />
+            <entry key='ansible-ssh-use-agent' value='false' />
+            <entry key='ansible-ssh-user' value='rundeck' />
+          </configuration>
+        </node-step-plugin>
+      </command>
+    </sequence>
+    <uuid>0f714bfb-a0a4-4668-8279-35a8c4167db9</uuid>
+  </job>
+</joblist>
\ No newline at end of file
diff --git a/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleDescribable.java b/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleDescribable.java
index 46649b92..be574e71 100644
--- a/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleDescribable.java
+++ b/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleDescribable.java
@@ -526,5 +526,6 @@ public static String[] getValues() {
             .required(false)
             .title("Encrypt Extra Vars.")
             .description("Encrypt the value of the extra vars keys.")
+            .defaultValue("true")
             .build();
 }
diff --git a/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleRunnerContextBuilder.java b/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleRunnerContextBuilder.java
index 77f3294f..29a3da55 100644
--- a/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleRunnerContextBuilder.java
+++ b/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleRunnerContextBuilder.java
@@ -810,7 +810,7 @@ public String getPassphraseStorageData(String storagePath) throws ConfigurationE
     public boolean encryptExtraVars() throws ConfigurationException {
         return PropertyResolver.resolveBooleanProperty(
                 AnsibleDescribable.ANSIBLE_ENCRYPT_EXTRA_VARS,
-                false,
+                true,
                 getFrameworkProject(),
                 getFramework(),
                 getNode(),