When Business Connectivity Services need to access external data which requires per-user authentication, it uses Secure Store Service to store the user password in order to avoid asking for it again and again.

Since the external data source needs the password itself, and not its hash, it means that Secure Store Service records the password itself, probably not in plain text, but still in a way it can be decrypted.

Every MSDN article (such as this one) I've read about Secure Store Service explains the benefits of using it, but not the internal workings.

How are passwords actually stored? If encryption is used, how is the decryption key stored?

In other words, are passwords safe if, for instance, a malicious person obtains an exact copy of the hard disk of a server hosting Secure Store Service? What if at instant t, the person has access to both the hard disk and the memory?

2 Answers 2


This post goes very deep on the topic: https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=65

  • I know. But I'm not going to plagiarize. If you care to improve my answer, please feel free to. Commented Feb 25, 2019 at 12:13

Using SharePoint API we can get the UserName and Password that is stored in Secure Store.

This will work only if the user context that the code is running is in the membership of the Target Application.


  • 1
    This doesn't address the question at all. He asked how the passwords are stored (and secured), not how to use secure store.
    – Joe McShea
    Commented Feb 14, 2019 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.