Credentials C:\Users\<utilisateur>\AppData\Roaming\Microsoft\Credentials

DPAPI-encrypted Credential Manager blobs (network and share passwords) for the user; unusable without the keys in Protect.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

The credentials that Windows and some applications save for the user (network access, shares, Credential Manager entries) are stored here as encrypted blobs. DPAPI (Data Protection API) protects them: only the user’s session, with its master keys from the neighboring Protect folder, can decrypt them.

What it contains

Hidden files with no extension and hexadecimal names. The format is internal to Windows and the content cannot be read directly. A folder of the same name also exists under %LOCALAPPDATA%\Microsoft\Credentials.

Risks and best practices

Deleting these files loses saved credentials. To remove just one, use Credential Manager or cmdkey /delete.
A copied file is useless without the master keys in Protect, but becomes exploitable for anyone who also has those keys and the user’s password. Back up the whole profile, never this folder alone, and protect the backup.
On sensitive workstations, limit credential saving through Group Policy and enable Credential Guard where the hardware supports it.
An unusual process reading these folders is a sign of credential theft; EDR and auditing can watch for it.

Useful commands

# Saved targets (names only, never passwords)
cmdkey /list

# Files present (hidden)
Get-ChildItem "$env:APPDATA\Microsoft\Credentials" -Force | Select-Object Name, Length, LastWriteTime

# Remove one specific credential with the supported tool
# cmdkey /delete:server01

Report a mistake