Obfuscating password in batch script

Question

I have a batch script with a password sitting in it as part of a command that requires credentials that I do not want to prompt for credentials. I am not worried about external threats, but I don't really want a co-worker going in there and seeing that password. While I trust them not to abuse it, I'd rather not have it there at all. I was able to do this pretty easily with PowerShell by just storing a secure string in a text file. Pretty basic, but at least there's no plain text passwords laying around. That's all I really need. How can I obfuscate a password in a batch script?

Accepted Answer

You could also hide the password in an alternate data stream:

First, add the somewhat secret password to an alternate data stream of your script:

```
echo somewhatsecretpassword>script.bat:pwd
```

Here's how to retrieve the password into the variable `%p%`:

```
for /f "usebackq delims=" %i in (script.bat:pwd) do set p=%i
```

From within the batch file itself you may use something like:

```
for /f "usebackq delims=" %%i in (%~0:pwd) do set p=%%i
```

This is not secure!

Please consider:

- This is not secure!

- Alternate data streams do not get copied everywhere (FAT)

- Passwords containing special characters may need to be escaped in order to get written correctly to the stream

- ... it is not secure

Obfuscating password in batch script

Solution

Problem