How to Find Passwords in Files with PowerShell?

by

Let’s be honest: people still store passwords in plain text files. I’ve seen it countless times — a “passwords.txt” sitting on someone’s desktop, a Word doc named “Important Logins.docx,” or configuration files with hardcoded credentials. It’s a security nightmare waiting to happen.

But you can use PowerShell to scan directories quickly and identify potential security risks before they become breaches.

In this tutorial, I will explain:

  • Search directories for files containing password-related keywords
  • Use pattern matching to find actual password formats (not just the word “password”)
  • Generate reports of your findings for security audits
  • Understand best practices for securing credentials properly

Now, let me show you several methods for finding passwords in files using PowerShell.

Method 1: Simple Keyword Search (Beginner-Friendly)

Let’s start with the easiest approach — searching for files that contain password-related keywords using PowerShell.

Step 1: Open PowerShell

Press Win + X and select “Windows PowerShell” (or “Terminal” on Windows 11). If you’re scanning system directories, you might need to run it as Administrator.

Step 2: Basic Search Command

Here’s a simple command to search for files containing the word “password”:

Get-ChildItem -Path "C:\Users\YourUsername\Documents" -Recurse -File | 
    Select-String -Pattern "password" -List | 
    Select-Object Path

What’s happening here?

  • Get-ChildItem lists all files in the specified path
  • -Recurse searches subdirectories too
  • -File only looks at files (not folders)
  • Select-String searches file contents for our pattern
  • -List stops after finding the first match in each file (faster!)
  • Select-Object Path shows just the file path

Step 3: Expand Your Search Terms

Real-world password files might use different terminology. Let’s search for multiple keywords:

Get-ChildItem -Path "C:\Users\YourUsername\Documents" -Recurse -File | 
    Select-String -Pattern "password|passwd|pwd|credential|username|login" -List | 
    Select-Object Path, Line, LineNumber

The | character means “OR” — so we’re searching for any of those terms.

Pro Tip: Include LineNumber in your output so you can quickly jump to the exact location in the file later.

Check out How to Find Unquoted Service Paths with PowerShell?

Method 2: Pattern Matching for Actual Passwords

Searching for the word “password” is useful, but what if you want to find things that look like actual passwords? Let’s use regular expressions (regex).

Search for Password-Like Patterns

This command looks for strings that match common password patterns — at least 4 characters with a mix of upper, lower, and numbers:

Get-ChildItem -Path "C:\Users\YourUsername\Documents" -Recurse -File -Include *.txt,*.doc*,*.csv,*.ini,*.config | 
    Select-String -Pattern '(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{4,15}' | 
    Select-Object Path, Line, LineNumber

Breaking down the regex pattern:

  • (?=.*[a-z]) — contains at least one lowercase letter
  • (?=.*[A-Z]) — contains at least one uppercase letter
  • (?=.*\d) — contains at least one digit
  • .{4,15} — between 4 and 15 characters total

This approach is more sophisticated and can catch actual password values.

Common Pitfall: Regex can return false positives. You might catch random text that happens to match the pattern. Always manually review the results!

Check out Why Does Windows PowerShell Keep Popping Up?

Method 3: Targeted File Search

In my experience, certain file types are more likely to contain passwords. Let’s focus our search:

Search Specific File Types

Here is the PowerShell script to find specific file types.

$fileTypes = "*.txt","*.ini","*.config","*.xml","*.json","*.ps1","*.bat","*.csv"
$searchPath = "C:\Users\YourUsername"

Get-ChildItem -Path $searchPath -Recurse -Include $fileTypes -File -ErrorAction SilentlyContinue | 
    Select-String -Pattern "password\s*[=:]\s*.+" -List | 
    Select-Object Path, Line

This searches for lines like:

  • password=MySecret123
  • password: something
  • password = value

Pro Tip: Add -ErrorAction SilentlyContinue to prevent errors when PowerShell hits protected system folders it can’t access.

Read Find Ports in Use using PowerShell

Method 4: Export Results to a Report

You can also export the results in a .CSV file for security updates.

Generate a CSV Report

Get-ChildItem -Path "C:\Users" -Recurse -Include *.txt,*.doc*,*.ini,*.config -File -ErrorAction SilentlyContinue | 
    Select-String -Pattern "password|credential|pwd" -List | 
    Select-Object Path, Line, LineNumber | 
    Export-Csv -Path "C:\PasswordAudit.csv" -NoTypeInformation

Write-Host "Audit complete! Results saved to C:\PasswordAudit.csv" -ForegroundColor Green

Now you have a spreadsheet you can review, share with your security team, or present to management.

Conclusion

We’ve covered four different methods for finding passwords in files using PowerShell — from simple keyword searches to sophisticated pattern matching and professional audit reports.

The techniques here work on Windows systems with PowerShell 5.1 or later (which is installed by default on Windows 10 and 11). Do let me know in the comments below if this helps.

You may also like the following tutorials:

100 PowerShell cmdlets download free

100 POWERSHELL CMDLETS E-BOOK

FREE Download an eBook that contains 100 PowerShell cmdlets with complete script and examples.