Rem: Masking Passwords in Scripts

Do you have a scripting-related question or problem? You can send your question or problem to [email protected].

I need to create a script that prompts the operator for a password. I know that I can use VBScript's InputBox function or the WScript object's StdIn property in Windows Script Host (WSH) to prompt the user. However, both InputBox and StdIn display the password as the user types it. I prefer to mask the password. Does VBScript or WSH provide a way to mask passwords?

Neither VBScript nor WSH can mask passwords. However, Windows .NET Server (formerly code-named Whistler) and Windows XP include a new password component, scriptpw.dll, that provides this functionality. Script-pw.dll is a standard system component that resides in the %system root% system 32 directory.

Listing 1 illustrates how you can use scriptpw.dll to retrieve a user's password without displaying the password as the user types it. The script begins by creating an instance of the Password object using VBScript's Create-Object function with the password component's programmatic identifier (ProgID), ScriptPW.Password.

Next, the script displays a prompt that tells the user to enter a password. After the user enters a password and presses Enter, the Password object's GetPassword method retrieves the password and returns the captured text as a string. The script stores the string in the strPassword variable. For the purpose of this example, the last line of the script echoes the value of strPassword. You wouldn't want to include this line in an actual script because it defeats the purpose of using scriptpw.dll to mask the password.

Because you can use the password component only at the command prompt, you must use the CScript host to run WSH scripts that call scriptpw.dll. Using the WScript host will result in an error.