.NET Framework Class Library
SecureString Class

Represents text that should be kept confidential. The text is encrypted for privacy when being used, and deleted from computer memory when no longer needed. This class cannot be inherited.

Namespace:  System.Security
Assembly:  mscorlib (in mscorlib.dll)
Syntax
Visual Basic (Declaration) 
Public NotInheritable Class SecureString _
    Inherits CriticalFinalizerObject _
    Implements IDisposable
Visual Basic (Usage) 
Dim instance As SecureString
C# 
public sealed class SecureString : CriticalFinalizerObject, 
    IDisposable
Visual C++ 
public ref class SecureString sealed : public CriticalFinalizerObject, 
    IDisposable
JScript 
public final class SecureString extends CriticalFinalizerObject implements IDisposable
Remarks

An instance of the System..::.String class is both immutable and, when no longer needed, cannot be programmatically scheduled for garbage collection; that is, the instance is read-only after it is created and it is not possible to predict when the instance will be deleted from computer memory. Consequently, if a String object contains sensitive information such as a password, credit card number, or personal data, there is a risk the information could be revealed after it is used because your application cannot delete the data from computer memory.

A SecureString object is similar to a String object in that it has a text value. However, the value of a SecureString object is automatically encrypted, can be modified until your application marks it as read-only, and can be deleted from computer memory by either your application or the .NET Framework garbage collector.

The value of an instance of SecureString is automatically encrypted when the instance is initialized or when the value is modified. Your application can render the instance immutable and prevent further modification by invoking the MakeReadOnly method.

Note that SecureString has no members that inspect, compare, or convert the value of a SecureString. The absence of such members helps protect the value of the instance from accidental or malicious exposure. Use appropriate members of the System.Runtime.InteropServices..::.Marshal class, such as the SecureStringToBSTR method, to manipulate the value of a SecureString object.

The SecureString class is derived from the CriticalFinalizerObject class and implements the IDisposable interface. For more information about implementing the IDisposable interface, see Garbage Collection.

The SecureString class and its members are not visible to COM. For more information, see ComVisibleAttribute.

Windows 2000 Platform Note: In addition to Windows 2000 Service Pack 4 and later, SecureString is supported on Windows 2000 Service Pack 3.

Windows 95, Windows 98, Windows 98 Second Edition, Windows Millennium Edition Platform Note: The SecureString class is not supported on Windows 98 or Windows Millennium Edition.

Inheritance Hierarchy
System..::.Object
  System.Runtime.ConstrainedExecution..::.CriticalFinalizerObject
    System.Security..::.SecureString
Thread Safety
Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.
Platforms

Windows 7, Windows Vista, Windows XP SP2, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP Starter Edition, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows Server 2000 SP4, Windows Millennium Edition, Windows 98

The .NET Framework and .NET Compact Framework do not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.
Version Information

.NET Framework

Supported in: 3.5, 3.0, 2.0
See Also

Reference

SecureString Members
System.Security Namespace
ComVisibleAttribute
Marshal
CriticalFinalizerObject
IDisposable
Tags :


Community Content

Sire404
The SecureString is NOT secure
This tool seem to be able to view SecureStrings: http://www.acorns.com.au/Projects/Hawkeye/
Tags :

LukeSkywalker
SecureString is somewhat secure
SecureString can be read with tools such as Hawkeye that have very high privileges, like debuggers have. However, SecureString should still be used to prevent less complicated clear text memory scans and, importantly, to prevent clear text passwords or hashes being read easily from memory dump files and page files.

A non-specific peice of malware will go for the low hanging fruit and that means clear text and easy to guess passwords.

LukeSkywalker
Cannot be used without Unmanaged Code privileges
Before working too hard on your implementation of SecureString, consider where your codebase will run from and whether or not you find having the permission to run unmanaged code is acceptable.

To read what you've stored in a SecureString, you must ensure that the decrypted string is never brought into managed code as a String, this would immediately invalidate the whole point of using SecureString in the first place.

To safely acheive this, the decrypted string is accessed via a pointer into the unmanaged world, which I understand is a barron and fiery land where beasts run free and giant volcanoes spew sulphur into the upper atmosphere, or something.

Page view tracker