# Encrypt Secrets

> Use PowerPack Password Encryptor to embed passwords and API keys as encrypted strings instead of plain text.

Source: https://docs.capaone.com/capainstaller/powerpacks/powerpack-tips-and-examples/encrypt-secrets/  
Product: CapaInstaller — a separate CapaSystems product; do not apply this page to any other.

Passwords, API keys, and other secrets that need to be embedded in a PowerPack script should never be stored as plain text. Use **PowerPack Password Encryptor** to generate an AES key and an encrypted string, then embed both in your script — the secret is only ever decrypted in memory at runtime.

:::note
A PowerPack script lives only in the CapaInstaller database and is sent straight from there into memory when the package runs — it never touches the client's file system. The only time it does is if you export or edit the script yourself. This makes embedding an encrypted secret directly in the script a reasonable way to ship it to clients, since there's no script file sitting on disk to expose it.
:::

Download the latest release of **PowerPack Password Encryptor** [from GitHub](https://github.com/Mark5900/PowerPack_Password_En-Decrypter/releases/latest), run it, and paste the generated `$key` and encrypted string into your script.

Once decrypted, the secret can be used either as a `PSCredential` object (for cmdlets that take a `-Credential` parameter) or as a plain string:

**PowerShell**

```powershell
# Use "PowerPack Password Encryptor.exe" to create these
$global:key = @(103, 2, 142, 17, 206, 124, 85, 76, 103, 104, 109, 163, 5, 155, 19, 142, 78, 103, 0, 79, 9, 98, 171, 192, 128, 141, 22, 139, 238, 177, 63, 232)
$global:encryptetPass = '76492d1116743f0423413b16050a5345MgB8AFkATQBIAFUAZwBDAFkARwByAGQAOQB0AGwAOQBGAFQAMgBUAHYAUgBUAFEAPQA9AHwAMQA5AGEAZQAxAGUANAAyADkANgAxADkAOAAzAGMANgBhAGYAMwA2ADkANgA5AGQAMABiADQAOQAxAGQAOQBkADMAMwAxADIANwBlAGQAMwA1AGEAMABlADMAZgBhADIAZgA3ADkAMABiAGYANgBmAGUANgBhAGQANgAwADkAOAA='
$global:username = 'PowerPackUser'

$cs.Log_SectionHeader('PowerShellCredentialObj', 'o')
$global:PsCredential = New-Object System.Management.Automation.PsCredential $global:username, ($global:encryptetPass | ConvertTo-SecureString -Key $global:key)

$cs.Log_SectionHeader('SecureAndUnsecureString', 'o')
$global:SecureString = $global:encryptetPass | ConvertTo-SecureString -Key $global:key
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($global:SecureString)
$global:UnsecurePassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
```