EncryptCredential

Author(s)

• florian.von.bracht@apteco.de

Tags

powershell Windows Linux Apteco

Functions

Convert-PlaintextToSecure Convert-SecureToPlaintext Export-Keyfile Import-Keyfile New-Keyfile

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

0.4.0 Encrypted strings are now really bound to the machine they were created on:
     a second encryption layer via DPAPI (Windows) or machine-id derived keys with
     AES + HMAC integrity protection (Linux/macOS) wraps the existing keyfile encryption.
     So a stolen ciphertext plus keyfile is useless on another machine.
     New -Scope parameter on Convert-PlaintextToSecure:
     'Machine' (default), 'User' (additionally bound to the current account) and
     'Portable' (old single-layer behaviour for moving ciphertexts between machines).
     Decryption stays downwards compatible - strings from older versions are detected
     and decrypted with the keyfile only.
     Export-Keyfile now re-applies restrictive file permissions to the exported copy
     and no longer switches to the new path if the copy failed.
     Import-Keyfile now validates that the file is a usable 16/24/32 byte AES key.
     Added a Pester test suite.
0.3.3 Fixed Convert-PlaintextToSecure calling New-Keyfile (the public, confirmation-gated wrapper with no -Path/-ByteLength params)
     instead of the private New-KeyfileRaw when auto-creating a missing keyfile. This threw a parameter binding error
     on any machine without an existing keyfile yet, e.g. fresh CI runners.
0.3.2 Fixed a bug where the module would not properly handle cases where the keyfile did not exist. Using New-Keyfile now instead of Create-Keyfile
0.3.1 Fixed returning an exception, when decryption failed instead of writing
     an error and returning an empty string
0.3.0 Reworked the module with Claude AI to be more secure and robust, now using another way to create
     a keyfile for salting. The old encryption method is still supported, so all
     previously encrypted strings will stay valid UNTIL you call New-Keyfile. After that,
     please re-encrypt all your credentials.
     Added ACL and linux file permission handling for the keyfile.
     Dispose the used AES object after encryption/decryption for better security.
     Changed internal functions verbs for more consistency
     Updated the copyright year to 2026
0.2.0 Tested successfully Linux support
0.1.2 Updated copyright to 2025
0.1.1 Bumped the copyright year to 2024
0.1.0 Making this module more mature with only explicit functions to export
     Removing not needed verbose output, use -verbose to see it again
     Fixed the path joining
0.0.2 Fixed a bug regarding output if a keyfile does not exist
0.0.1 Initial release through PSGallery