DataProtectionDecryptor

DataProtectionDecryptor is an application designed to autodetect passwords and other information encrypted with DPAPI (Data Protection API), a Windows feature used to store keys and other secret data. It can save the recovered info to file.

Some examples of passwords encrypted with DPAPI include Microsoft Office accounts, Credentials files, wireless network keys, passwords from older Internet Explorer versions, Chrome keys, and Chrome encrypted cookies.

This is a portable product so installation isn't necessary. You can unzip the downloaded file and double-click the .exe to fire up the utility as well as save it to a USB thumb drive to run it on any PC without setup. It autocreates a configuration file in the same directory to remember your settings.

At startup, you're welcomed by the DPAPI decryption configuration panel, where you can begin by choosing the decryption mode. In addition to recovering data from the current operating system and logged on user, DataProtectionDecryptor is capable of retrieving it from an external drive or another PC user.

For the second option, you have to indicate the root, protect and registry hives folders, along with the Windows login password. If you run the app with admin permissions, you can ask the tool to attempt to decrypt data by executing code inside the Lsass.exe process.

The software tool can recover information from a specified string (2-digit hexadecimal numbers) or any specified files (wildcards are allowed). An extra key may be optionally specified for decrypting information (entropy) in hex, ANSI string key or UTF-16 string key format.

In the main app window, you can check out the decrypted and encrypted size, description, hash and crypt algorithm, along with other details for each entry. Clicking an entry reveals its hexadecimal code on the bottom side of the panel. All info can be exported to file.

All aspects considered, DataProtectionDecryptor offers a simple and straightforward solution for decrypting passwords encrypted with DPAPI and saving this information to file. It worked smoothly on the latest Windows version in our testing.