anchor.diff:                  ProtectedData.Protect(Encoding.UTF8.GetBytes password, salt, DataProtectionScope.LocalMachine)
           encryptedPassword |> Convert.ToBase64String |> DPApiEncryptedPassword,
           salt |> DPApiSalt.encode
  -        
  +
       let decrypt (encryptedPassword : string) (salt : string)  =
           ProtectedData.Unprotect(Convert.FromBase64String encryptedPassword, Convert.FromBase64String salt, DataProtectionScope.CurrentUser)
           |> Encoding.UTF8.GetString
           |> PlainTextPassword
  -        
  +
   [<RequireQualifiedAccess>]
   module Crypto =
  -    let encrypt plainTextPassword = 
  +    let encrypt plainTextPassword =
           if Utils.isWindows then
               let (dpApiPassword, dpApiSalt) = DPApi.encrypt plainTextPassword
               (EncryptedPassword.DPApi dpApiPassword, Salt.DPApi dpApiSalt)
           else
               let (aesPassword, aesSalt) = Aes.encrypt plainTextPassword
               (EncryptedPassword.Aes aesPassword, Salt.Aes aesSalt)
  -            
  +
       let decrypt password salt =
           match salt with
  -        | AesSalt.IsAesSalt salt -> 
  +        | AesSalt.IsAesSalt salt ->
               Aes.decrypt (AesEncryptedPassword password) salt
           | _ ->
               DPApi.decrypt password salt
positive.code: [<RequireQualifiedAccess>]
  module private AesSalt =
      let [<Literal>] saltSeparator = "SALT_SEPARATOR"
          
      let private toBytes (AesKey keyString, AesIV ivString) =
          (AesKey << Convert.FromBase64String) keyString,
          (AesIV << Convert.FromBase64String) ivString
          
      let encode ((AesKey key): AesKey<byte[]>,(AesIV iv): AesIV<byte[]>) =
          seq {key;iv}
          |> Seq.map Convert.ToBase64String
          |> String.concat saltSeparator
          |> AesSalt
          
      let decode (AesSalt saltString) =
          match saltString.Split([|saltSeparator|], StringSplitOptions.None)  with
          | [|keyString;ivString|] -> (AesKey keyString, AesIV ivString)
          | _ -> failwith "Should never happen"
          
      let (|IsAesSalt|_|) (str: string) =
          if str.Contains saltSeparator then
              Some <| AesSalt str
          else
              None
      
  [<RequireQualifiedAccess>]
  module Aes =    
      let private encryptString (password: string) =
          let writePassword (cryptoStream: CryptoStream) =
              use streamWriter = new StreamWriter(cryptoStream)
              streamWriter.Write(password)
              
          use aes = Aes.Create()
          let encryptor = aes.CreateEncryptor()
          use memoryStream = new MemoryStream()
  
negative.code:         writePassword cryptoStream
          let encryptedPassword = memoryStream.ToArray()
          encryptedPassword,aes.Key,aes.IV
  
      let private decryptBytes (encryptedBytes: byte[]) key iv =
          use aes = Aes.Create()
          aes.Key <- key
          aes.IV <- iv
  