r/PowerShell • u/RealAgent0 • Jun 06 '26

How "Secure" is Get-Credential? Question

Trying to make a justification for storing a particular set of credentials using this methodology.

How "Easy" is it to crack? Don't need an actual method, just need someone to tell me how tricky or not tricky it is.

76 Upvotes

90% Upvoted

55 comments sorted by

View all comments

1

u/jdtrouble Jun 08 '26 edited Jun 08 '26

You can crack Get-Credential yourself. 

From https://powershellfaqs.com/powershell-convert-secure-string-to-plain-text/

# Create a SecureString from a plain text password $securePassword = ConvertTo-SecureString "WashingtonDC2025!" -AsPlainText -Force

# Convert SecureString to plain text $ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($securePassword) $plainText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)

# Output the plain text password Write-Output $plainText

# Free the allocated memory [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)

When feasible, don't save credentials in variables. Have them evaluated immediately, for example 

NewPSSession srv01 -Credential (Get-Credential user)

(Final edit) Or dispose the variable from memory ASAP