Encrypt Secrets

Passwords, API keys, and other secrets that need to be embedded in a PowerPack script should never be stored as plain text. Use PowerPack Password Encryptor to generate an AES key and an encrypted string, then embed both in your script — the secret is only ever decrypted in memory at runtime.

Note

A PowerPack script lives only in the CapaInstaller database and is sent straight from there into memory when the package runs — it never touches the client’s file system. The only time it does is if you export or edit the script yourself. This makes embedding an encrypted secret directly in the script a reasonable way to ship it to clients, since there’s no script file sitting on disk to expose it.

Download the latest release of PowerPack Password Encryptor from GitHub, run it, and paste the generated $key and encrypted string into your script.

Once decrypted, the secret can be used either as a PSCredential object (for cmdlets that take a -Credential parameter) or as a plain string:

• PowerShell

# Use "PowerPack Password Encryptor.exe" to create these
$global:key = @(103, 2, 142, 17, 206, 124, 85, 76, 103, 104, 109, 163, 5, 155, 19, 142, 78, 103, 0, 79, 9, 98, 171, 192, 128, 141, 22, 139, 238, 177, 63, 232)
$global:encryptetPass = '76492d1116743f0423413b16050a5345MgB8AFkATQBIAFUAZwBDAFkARwByAGQAOQB0AGwAOQBGAFQAMgBUAHYAUgBUAFEAPQA9AHwAMQA5AGEAZQAxAGUANAAyADkANgAxADkAOAAzAGMANgBhAGYAMwA2ADkANgA5AGQAMABiADQAOQAxAGQAOQBkADMAMwAxADIANwBlAGQAMwA1AGEAMABlADMAZgBhADIAZgA3ADkAMABiAGYANgBmAGUANgBhAGQANgAwADkAOAA='
$global:username = 'PowerPackUser'

$cs.Log_SectionHeader('PowerShellCredentialObj', 'o')
$global:PsCredential = New-Object System.Management.Automation.PsCredential $global:username, ($global:encryptetPass | ConvertTo-SecureString -Key $global:key)

$cs.Log_SectionHeader('SecureAndUnsecureString', 'o')
$global:SecureString = $global:encryptetPass | ConvertTo-SecureString -Key $global:key
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($global:SecureString)
$global:UnsecurePassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)