Obfuscating password in batch script

Question

I have a batch script with a password sitting in it as part of a command that requires credentials that I do not want to prompt for credentials. I am not worried about external threats, but I don't really want a co-worker going in there and seeing that password. While I trust them not to abuse it, I'd rather not have it there at all.

I was able to do this pretty easily with PowerShell by just storing a secure string in a text file. Pretty basic, but at least there's no plain text passwords laying around. That's all I really need.

How can I obfuscate a password in a batch script?

Answer 1

You could also hide the password in an alternate data stream:

First, add the somewhat secret password to an alternate data stream of your script:

echo somewhatsecretpassword>script.bat:pwd

Here's how to retrieve the password into the variable %p%:

for /f "usebackq delims=" %i in (script.bat:pwd) do set p=%i

From within the batch file itself you may use something like:

for /f "usebackq delims=" %%i in (%~0:pwd) do set p=%%i

This is not secure!

Please consider:

• This is not secure!
• Alternate data streams do not get copied everywhere (FAT)
• Passwords containing special characters may need to be escaped in order to get written correctly to the stream
• ... it is not secure

Answer 2

Another option might be to obfuscate a "password", which is not secure at all but might be sufficent in certain situations

:main
set a=pas
set b=rd
set /p input=
if %input%==%a%swo%b% goto start
:start
<your code here>
goto main

the password is "password", but it's a bit obfuscated.