# Windows Credential Manager

> Use when storing/retrieving credentials securely on Windows.

- Skill: `loopyluci/windows-credential-manager` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/windows-credential-manager`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/windows-credential-manager/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/windows-credential-manager

---

# Windows Credential Manager

Storing and retrieving credentials securely on Windows.

## Credential Manager (Built-in)

```powershell
# Store a credential
$cred = Get-Credential
$cred | Export-CliXml -Path "C:\scripts\cred.xml"

# Load a credential (only same user can decrypt)
$cred = Import-CliXml -Path "C:\scripts\cred.xml"
$cred.UserName
$cred.GetNetworkCredential().Password
```

## Windows Credential Vault (cmdkey)

```batch
REM Add generic credential
cmdkey /add:MyServer /user:admin /pass:MyPassword

REM List
cmdkey /list

REM Delete
cmdkey /delete:MyServer
```

## PowerShell SecretManagement Module (PS 7+)

```powershell
# Install
Install-Module -Name Microsoft.PowerShell.SecretManagement -Force
Install-Module -Name Microsoft.PowerShell.SecretStore -Force

# Register vault
Register-SecretVault -Name MyVault -ModuleName Microsoft.PowerShell.SecretStore

# Store
Set-Secret -Name "DockerHubToken" -Secret "abc123"
Set-Secret -Name "DBCreds" -Secret (ConvertTo-SecureString "pass" -AsPlainText -Force)

# Retrieve
Get-Secret -Name "DockerHubToken"
Get-Secret -Name "DBCreds" | ConvertFrom-SecureString

# List
Get-Secret -Vault MyVault

# Remove
Remove-Secret -Name "DockerHubToken"
```

## CredSSP / Secure Strings

```powershell
# ConvertTo-SecureString with key (portable)
$key = (1..16)
$secure = ConvertTo-SecureString -String "MyPassword" -AsPlainText -Force
$encrypted = ConvertFrom-SecureString -SecureString $secure -Key $key
# Store $encrypted string in file
$encrypted | Out-File "pass.txt"
# Decrypt later
$secure = ConvertTo-SecureString -String (Get-Content "pass.txt") -Key $key
```

## Avoid Plain Text in Scripts

```powershell
# BAD: plain text in script
$password = "P@ssw0rd"

# GOOD: interactively prompt at runtime
$cred = Get-Credential

# GOOD: load from encrypted file
$cred = Import-CliXml -Path "cred.xml"
```

## Pitfalls

- **Export-CliXml** uses DPAPI -- only same user on same machine can decrypt
- **cmdkey** stores in plaintext (obfuscated, not encrypted) -- use with caution
- **SecretManagement** requires PS 7 and module installation
- **Get-Credential** can't be automated (always shows GUI prompt)
- **SecureString** in memory can still be dumped by malware running as same user