PowerShell - Decode System.Security.SecureString to readable password

Question

I want to decode the password from a System.Security.SecureString to a readable password.

$password = convertto-securestring "TestPassword" -asplaintext -force
$credentials = New-Object System.Net.NetworkCredential("TestUsername", $password, "TestDomain")

This code part works fine, I can use the $credentials object. But later in my code I need the password in a readable format. Because a methode needs the password in readable string. So I must decode the password back.

How it is possible to decode the password from the $credentials object?

Update

Not working:

$password = convertto-securestring "TestPassword" -asplaintext -force
$credentials = New-Object System.Net.NetworkCredential("TestUsername", $password, "TestDomain")

$Ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($credentials.password)
$result = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($Ptr)
[System.Runtime.InteropServices.Marshal]::ZeroFreeCoTaskMemUnicode($Ptr)
$result

Once you have the `PSCredentials` object, you can just do: ```$credentials.GetNetworkCredential().Password``` — CubanX, Sep 16 '16 at 15:29

Shay Levy · Accepted Answer · 2011-09-19T17:33:22.260

59

Here you go:

$password = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force

$Ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($password)
$result = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($Ptr)
[System.Runtime.InteropServices.Marshal]::ZeroFreeCoTaskMemUnicode($Ptr)
$result

P@ssw0rd

edited Sep 19 '11 at 17:33

answered Sep 19 '11 at 10:27

Shay Levy

121,444
32
184
206

Thank for your answer! That helps me a lot! But why is it not possible to use the same code with $credentials.password ? – LaPhi Sep 19 '11 at 16:10
But why is that code nocht working for $credentials.password ? Are there differnt SecureStrings? Or is the key for the encryption a other? – LaPhi Sep 20 '11 at 07:40
i am getting blank space when i try to print the result. Please help . – Moose Jul 31 '15 at 10:56

score 21 · Answer 2 · answered Jan 29 '15 at 21:20

For a "System.Net.NetworkCredential" object, all you need to do is read the String password.

$password = convertto-securestring "TestPassword" -asplaintext -force
$credentials = New-Object System.Net.NetworkCredential("TestUsername", $password, "TestDomain")
$credentials.Password
TestPassword

$credentials | gm

TypeName: System.Net.NetworkCredential

Name           MemberType Definition
----           ---------- ----------
Equals         Method     bool Equals(System.Object obj)
GetCredential  Method     System.Net.NetworkCredential GetCredential(uri uri, str
GetHashCode    Method     int GetHashCode()
GetType        Method     type GetType()
ToString       Method     string ToString()
Domain         Property   string Domain {get;set;}
Password       Property   string Password {get;set;}
SecurePassword Property   securestring SecurePassword {get;set;}
UserName       Property   string UserName {get;set;}

If you end up with a PSCredential object, from an interactive command like Get-Credential use

$credentials=Get-Credential
$credentials.GetNetworkCredential().UserName
TestUsername
$credentials.GetNetworkCredential().Domain
TestDomain
$credentials.GetNetworkCredential().Password
TestPassword

See http://blogs.technet.com/b/heyscriptingguy/archive/2013/03/26/decrypt-powershell-secure-string-password.aspx for details.

Note: I used PS 4 for this example.

score 10 · Answer 3 · edited Feb 05 '14 at 12:19

10

($credentials.GetNetworkCredential()).Password

edited Feb 05 '14 at 12:19

Baby Groot

4,637
39
52
71

answered Feb 05 '14 at 12:01

user3234250

101
1
2

score 7 · Answer 4 · answered Nov 13 '13 at 09:56

The details are explained http://blogs.msdn.com/b/besidethepoint/archive/2010/09/21/decrypt-secure-strings-in-powershell.aspx

and I have yet another slightly different way of doing it.

$pass=convertto-securestring "P@ssw0rd" -asplaintext -force  | ConvertFrom-SecureString
[Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR( (ConvertTo-SecureString $pass) ))

P@ssw0rd

score 7 · Answer 5 · answered Apr 01 '21 at 20:03

Rob's post above did not work for me for some reason. I found an answer from another site.

Multiple lines of code version:

$password = ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force

$decrypted = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($password)
$decryptedPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($decrypted)
$decryptedPassword    # Outputs: P@ssw0rd

One-liner version (which you can save to a variable):

# Outputs: P@ssw0rd
[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($password))

PowerShell - Decode System.Security.SecureString to readable password

5 Answers5

Linked

Related