| description | Avoid Using SecureString With Plain Text |
|---|---|
| ms.date | 07/21/2026 |
| ms.topic | reference |
| title | AvoidUsingConvertToSecureStringWithPlainText |
Severity Level: Error
Default state: Always enabled
This rule detects the use of the AsPlainText parameter with the ConvertTo-SecureString command,
which bypasses encryption and exposes sensitive information in memory as plain text, defeating the
purpose of SecureString.
Instead, retrieve secure credentials through encrypted channels or use secure input methods like
Read-Host -AsSecureString to ensure sensitive data remains encrypted throughout its lifecycle.
If you need to retrieve passwords programmatically without user interaction, consider using the SecretStore module from the PowerShell Gallery, which provides encrypted credential storage and retrieval.
$UserInput = Read-Host 'Please enter your secure code'
$EncryptedInput = ConvertTo-SecureString -String $UserInput -AsPlainText -Force$SecureUserInput = Read-Host 'Please enter your secure code' -AsSecureStringThis rule is always enabled and isn't configurable. Use one of the following methods to avoid using this rule:
- Create a custom rule configuration file to include only the rules you want or exclude the rules you don't want.
- Add the appropriate rule suppression attributes to your code to suppress the rule for specific code blocks. For more information, see the Suppressing rules section of Using PSScriptAnalyzer.