Last updated: April 29, 2026
Why this module exists. DPAPI is how Windows stores “secrets” — Wi-Fi passwords, browser-saved credentials, RDP credentials, OneDrive tokens, certificates. Attackers who understand DPAPI extract dozens of credentials per compromised host. Defenders who don’t understand it can’t tell which alert means “credential theft” vs “noise”.
The DPAPI mental model
Each Windows user has a master key derived from their password (and a domain backup key on domain-joined machines). Applications encrypt secrets using a key derived from the master key. The OS enforces “only this user can decrypt these blobs.”
What’s protected by DPAPI on a typical workstation:
- Wi-Fi profile keys (
%PROGRAMDATA%MicrosoftWlansvcProfiles) - Chrome / Edge / Firefox saved passwords
- Saved RDP credentials (
%APPDATA%MicrosoftCredentials) - Outlook saved passwords
- OneDrive / SharePoint authentication tokens
- Certificate private keys (
%APPDATA%MicrosoftCrypto) - Windows Credential Manager entries
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.