--- title: "Fixing MSDN's bad DPAPI examples (And what's DPAPI anyway?)" url: "https://osherove.com/blog/2005/7/11/fixing-msdns-bad-dpapi-examples-and-whats-dpapi-anyway.md" canonical: "https://osherove.com/blog/2005/7/11/fixing-msdns-bad-dpapi-examples-and-whats-dpapi-anyway.html" published: "2005-07-11T18:38:00" updated: "2005-07-11T18:38:00" tags: ["Cool Articles"] author: "Roy Osherove" description: "DPAPI (Data Protection API) is something that most developers still don't know enough about. The good news is that working with it is much easier with .NET 2.0 and VS 2005, but in the meantime, if you want to work with…" usage: "Licensed under CC BY 4.0 — reuse, quote and adapt with attribution (Roy Osherove, link to the original page)." license: "https://creativecommons.org/licenses/by/4.0/" --- # Fixing MSDN's bad DPAPI examples (And what's DPAPI anyway?) By Roy Osherove July 11, 2005 In [Cool Articles](https://osherove.com/blog/category/cool-articles) **Historical article** · Originally published July 11, 2005; technical details may be outdated. DPAPI (Data Protection API) is something that most developers **still** don't know enough about. The good news is that working with it is much easier with .NET 2.0 and VS 2005, but in the meantime, if you want to work with secure data (encrypted), using DPAPI is not the easiest thing in the word. It's mostly unmanaged APIs, and you'd have to create a wrapper class (or set of classes) to work with it. Fortunately for us developers, Microsoft has an MSDN article on the subject. The only problem is that it's code samples (which many people use to start of their own class wrappers) are of very bad quality and even contains some serious bugs, So feel free to [read the MSDN article](http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secmod/html/secmod21.asp), but **don't use the code samples from it**. Instead, use the code samples from [**this article**](http://devprime.com/Article2061.aspx) which goes through the painful process of detailing all the **bad things** in the code sample in the first article including a bad memory leak bug. And if anyone at MS is reading this that can help fix those code samples - that'd be great! _(found via_ [_this blog_](http://devauthority.com/blogs/devprime/archive/2005/07/10/215.aspx)_, located in the newly formed_ [_DeveAuthority blogsphere_](http://devauthority.com/blogs/)_)_ _**Update**: Joe writes in the comments:_ _Even better than the corrected sample: use NCrypto (_[_http://ncrypto.sourceforge.net/default.htm_](http://ncrypto.sourceforge.net/default.htm)_)._ _The API is very similar to what's coming in .NET 2.0._ Thanks Joe! ## More in Cool Articles [All posts in Cool Articles](https://osherove.com/blog/category/cool-articles) - Nov 26, 2005 ### [Nice article on ordering code construction tasks by Jeremy Miller](https://osherove.com/blog/2005/11/26/nice-article-on-ordering-code-construction-tasks-by-jeremy-m.html) - Jul 29, 2005 ### [Nice article: Agile Top-Down](https://osherove.com/blog/2005/7/29/nice-article-agile-top-down.html) - Jun 26, 2005 ### [Great article on Reflection and Performance on MSDN Mag](https://osherove.com/blog/2005/6/26/great-article-on-reflection-and-performance-on-msdn-mag.html) - May 10, 2005 ### [\[Article\]Simplify Data Layer Unit Testing using Enterprise Services](https://osherove.com/blog/2005/5/10/articlesimplify-data-layer-unit-testing-using-enterprise-ser.html) --- ## About the author **Roy Osherove**: Senior Solutions Architect at AWS working on AI for production and AI-driven development; author of The Art of Unit Testing and Elastic Leadership, with about 20 years of consulting and training on unit testing, TDD, team leadership and continuous delivery. ### Sites - [RobotPaper](https://robotpaper.ai/): This blog: AI patterns and anti-patterns, AI and coding agents, and engineering leadership. - [osherove.com](https://osherove.com): Roy's personal site. Author of The Art of Unit Testing and Elastic Leadership; consulting and training on unit testing, TDD, team leadership and continuous delivery, plus about 20 years of blog posts. - [The Art of Unit Testing](https://www.artofunittesting.com): The Art of Unit Testing, 3rd Edition (Manning): readable, maintainable, trustworthy unit tests, plus TDD workshops in C#, JavaScript, Java and Kotlin. - [5whys.com](https://www.5whys.com): Roy's writing on software team leadership: self-organizing teams, surviving chaos, learning mode and the Elastic Leadership model. - [Pipeline Driven](https://pipelinedriven.org): Continuous delivery and DevOps practices: build patterns, pipeline-friendly testing, DevOps metrics and enterprise DevOps. - [Elastic Leadership](https://www.elasticleadership.com): Elastic Leadership, Roy's framework for software team leaders (survival, learning and self-organizing modes). ### Social - X: https://x.com/royosherove - LinkedIn: https://www.linkedin.com/in/osherove/ ### Contact - Contact form: https://forms.gle/jQSx5KoXvrVA1JCK7 ### License Licensed under CC BY 4.0 — reuse, quote and adapt with attribution (Roy Osherove, link to the original page). License: https://creativecommons.org/licenses/by/4.0/