ConvertTo-SecureString
Use ConvertTo-SecureString to turn plain text into a SecureString for credentials — or to decrypt a stored secure string back into a credential.
Documentation: Microsoft Learn — convertto-securestring
Syntax
Try it
PowerShell example · browser support is limited.
Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.
Examples
Convert plain text to a secure string
Show reference output
Illustrative output · values vary by environment
(no output; $sec now holds a SecureString)
Build a credential from a secure string
Show reference output
Illustrative output · values vary by environment
(credential object ready for -Credential parameters)
Store an encrypted password and load it back
Show reference output
Illustrative output · values vary by environment
(the file holds encrypted text, readable only by the same user on the same computer)
Parameters
Parameter definitions:
-String— The text to convert. With -AsPlainText it is a readable password; otherwise it is an encrypted standard string.-AsPlainText -Force— Required together to convert readable text. The -Force acknowledges the security risk.-Key— A 16, 24, or 32-byte key used to encrypt or decrypt the string, so it can move between computers.-SecureKey— A SecureString holding the encryption key, instead of a plain byte array.
AsPlainText in a script defeats the whole point
ConvertTo-SecureString -AsPlainText -Force is fine for a quick interactive test. In a saved script it is worse than useless: the password sits in plain text in the file, and the SecureString wrapper only hides it from casual screen-reading. Anyone who opens the script has the password.
For unattended scripts, the safe pattern is: once, interactively, run Read-Host -AsSecureString | ConvertFrom-SecureString | Out-File, then at runtime load it with Get-Content | ConvertTo-SecureString. The file is encrypted with your Windows account, so only the same user on the same computer can decrypt it.
If the credential must work on another computer or under another account, encrypt with an explicit -Key instead. Guard that key as carefully as the password itself, because anyone with the key and the file can decrypt the password.
Prompt for credentials with Get-Credential
Read passwords securely with Read-Host
Updated 25 October 2026. Browser outputs are fictional; check the installed module help for your environment.
Recap
ConvertTo-SecureString Use ConvertTo-SecureString to turn plain text into a SecureString for credentials — or to decrypt a stored secure string back into a credential.
Next: Add Member