Inspect RDPea, from bluewhackadoo, a Windows utility that extracts and decrypts Remote Desktop Protocol credentials stored locally. It scans the Windows Credential Manager and uses the system Data Protection API to convert encrypted blobs into readable usernames and passwords via a command-line interface, identifying hostnames and associated accounts. No complex installation is required, and the project is open-source for code inspection. Administrators and security professionals gain a portable auditing and recovery tool for local profiles.

What the tool locates and reveals

The tool targets saved Remote Desktop credentials inside the Windows Credential Manager. It locates RDP-specific entries, extracts associated usernames and host identifiers, and uses the local Data Protection API to decrypt password blobs into plain text. Running from a command-line interface lets administrators enumerate, filter, and export results to text, which fits scripted audits and single-machine recovery tasks where credentials remain tied to local user profiles.

Does it impact system resources during use?

Because the design emphasises minimal overhead, enumeration and decryption are local operations that avoid lengthy disk scans or network activity. Work consists of reading Credential Manager entries and invoking DPAPI decryption, so the tool does not introduce extended CPU- or I/O-intensive passes. Execution depends on the presence of a compatible .NET runtime, so deployment requires that runtime to be available on the target desktop.

Is it safe to run on production machines?

Safety relies on account scope and privileges: the tool uses the Windows Data Protection API, the same mechanism Windows uses to protect secrets, and its open-source status allows code inspection of decryption steps and file handling. Administrative rights may be necessary to access credentials saved by other users or system accounts, so operators should verify account boundaries and run in a controlled environment when auditing production systems.

Do you need technical knowledge to operate it?

Using the tool requires command-line familiarity and an understanding of Windows account boundaries. The CLI makes it suitable for scripted audits, batch enumeration, and portable one-off runs because there is no complex installer. The stated audience is system administrators, IT professionals, and security researchers; casual users without command-line experience may find the interface terse and should prepare a controlled test environment before running the tool on important machines.

A practical auditing and recovery tool with a command-line trade-off

RDPea is a practical option for administrators who need to recover or audit saved RDP credentials on a machine-local basis. It provides transparent, inspectable decryption using the system protection mechanism and integrates into scripted workflows. The main caveat is its command-line focus combined with account-privilege limits, which reduce suitability for non-technical users. It performs reliably for targeted credential-retrieval and audit tasks on desktop systems.