title: Is it secure to use a password argument in a Windows command?
body: <p>Imagine that we have a program or script that can take a password (or other sensitive information) argument: </p>
  
  <pre><code>&gt; program.exe /password:secret
  </code></pre>
  
  <p>For Linux, best practice generally recommends <em>against</em> specifying the password directly on the command-line because of potential security concerns (the password can appear in the shell's history file and the system's process table): </p>
  
  <pre class="lang-shell prettyprint-override"><code>$ ./program.sh --password 'secret' &amp;
  [1] 4152
  
  $ cat /proc/4152/cmdline 
  /bin/sh./program.sh--passwordsecret
  </code></pre>
  
  <p>However, when searching around, I don't see the same vigorous recommendation for Windows. </p>
  
  <p>When writing programs and scripts for <em>Windows</em>, should we provide an alternate means to input a password besides an argument to a command-line option to avoid unintentionally exposing the password?</p>
  
  <p>The answer to <a href="https://stackoverflow.com/q/13073765/5209322">this question</a> suggests that a dedicated password input prompt improves security by preventing shoulder-surfing. Are there any other ways to exploit a visible password in a command string that justifies writing alternate input methods, both in the context of a shell and in the way Windows manages processes?</p>
  
  <p>Do the security implications change when starting a program from a batch file or PowerShell script that passes a password as an argument to the program?</p>
  
  <pre><code>$password = # prompt for password 
  program.exe /password:$password
  </code></pre>
  
  <p><strong>Edit</strong> - I understand that we can misinterpret this question as opinion-based because I mention "best practices" and "recommendations" to provide background. However, I seek specific evidence that demonstrates how a password might be vulnerable in a command argument and&mdash;if this assumption is valid&mdash;concrete examples or references that depict secure alternatives.</p>