diff --git a/Elysium.ps1 b/Elysium.ps1
index 7c5e2f8..428ab0e 100644
--- a/Elysium.ps1
+++ b/Elysium.ps1
@@ -39,17 +39,26 @@ if (-Not (Test-Path $settingsFilePath)) {
     Write-Host "ElysiumSettings.txt found."
 }
 
-# Attempt to retrieve the passphrase from the environment variable
-$passphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
+# The passphrase is persisted DPAPI-protected (current user + machine) via ConvertFrom-SecureString,
+# never in plaintext, so it's only prompted for once per user/machine and never echoed to the console.
+$storedPassphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
 
-if ([string]::IsNullOrEmpty($passphrase)) {
+$havePassphrase = $false
+if (-not [string]::IsNullOrEmpty($storedPassphrase)) {
+    try {
+        [void](ConvertTo-SecureString -String $storedPassphrase -ErrorAction Stop)
+        $havePassphrase = $true
+        Write-Host "Passphrase found in environment variables."
+    } catch {
+        Write-Warning "Stored passphrase is not in the expected protected format (leftover from an older Elysium version?). Re-enter it."
+    }
+}
+
+if (-not $havePassphrase) {
     Write-Host "No passphrase found in environment variables."
-    $passphrase = Read-Host "Please enter your passphrase."
-    # Here you could choose to set the environment variable or simply use the passphrase for the current session
-    [System.Environment]::SetEnvironmentVariable("ELYSIUM_PASSPHRASE", $passphrase, [System.EnvironmentVariableTarget]::User)
-    Write-Host "Passphrase stored as environment variable 'ELYSIUM_PASSPHRASE'."
-} else {
-    Write-Host "Passphrase found in environment variables."
+    $securePassphrase = Read-Host "Please enter your passphrase" -AsSecureString
+    [System.Environment]::SetEnvironmentVariable("ELYSIUM_PASSPHRASE", (ConvertFrom-SecureString -SecureString $securePassphrase), [System.EnvironmentVariableTarget]::User)
+    Write-Host "Passphrase stored (DPAPI-protected) as environment variable 'ELYSIUM_PASSPHRASE'."
 }
 
 function Start-OrchestratorTranscript {
diff --git a/Extract-NTHashes.ps1 b/Extract-NTHashes.ps1
index 2c150a0..0c24c93 100644
--- a/Extract-NTHashes.ps1
+++ b/Extract-NTHashes.ps1
@@ -190,9 +190,15 @@ try {
     try { $s3ForcePathStyle = [System.Convert]::ToBoolean($s3ForcePathStyle) } catch { $s3ForcePathStyle = $true }
     try { $s3UseAwsTools = [System.Convert]::ToBoolean($s3UseAwsTools) } catch { $s3UseAwsTools = $false }
 
-    # Retrieve the passphrase from a user environment variable
-    $passphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
-    if ([string]::IsNullOrWhiteSpace($passphrase)) { throw 'Passphrase not found in ELYSIUM_PASSPHRASE environment variable.' }
+    # Retrieve the DPAPI-protected passphrase from a user environment variable (see Elysium.ps1)
+    $protectedPassphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
+    if ([string]::IsNullOrWhiteSpace($protectedPassphrase)) { throw 'Passphrase not found in ELYSIUM_PASSPHRASE environment variable. Run Elysium.ps1 once to set it.' }
+    try {
+        $securePassphrase = ConvertTo-SecureString -String $protectedPassphrase -ErrorAction Stop
+    } catch {
+        throw "ELYSIUM_PASSPHRASE is not in the expected DPAPI-protected format (leftover from an older Elysium version?). Re-run Elysium.ps1 to re-enter it."
+    }
+    $passphrase = [System.Net.NetworkCredential]::new('', $securePassphrase).Password
 
     $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"