powershell/secretstore

PowerShell SecretStore is a tool that lets you keep passwords, API keys, and other sensitive information right on your own computer in an encrypted file. It is designed for people who write PowerShell scripts and need a secure place to stash secrets instead of leaving them in plain text or pasting them directly into scripts. When you save a secret, it gets encrypted and written to a file tied to your user account. The data stays encrypted even while sitting in memory, and is only decrypted at the moment you ask for it back. By default, it requires a password to unlock, you type it once, and it stays unlocked for a configurable window (15 minutes by default) before asking again. You can also attach metadata to secrets, like notes about what they are for. The main audience is IT professionals, system administrators, and anyone writing PowerShell automation. For example, if you have a script that connects to a database or a cloud service, you can retrieve the needed credentials from the store at runtime instead of hardcoding them. It works across Windows, Linux, and macOS. For automated jobs where a human is not around to type a password, you can configure it to run without prompting, though that mode is less secure because the decryption key lives in a local file. One notable thing is that the PowerShell team has declared this project feature complete and is winding it down. They point out that the landscape has shifted toward passwordless authentication, passkeys, biometrics, single sign-on, and hardware security keys, which the current design cannot meaningfully support. They will still fix security issues, but no new capabilities are planned. This makes it a solid choice for existing PowerShell workflows that need simple, local secret storage, but not something to build long-term plans around if you are starting fresh.