How to Store Binary Files (.ZIP) in the Privileged Access Manager (PAM) Secret Vault

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Cloakware Password Authority (PA)

Issue/Introduction

Standard Secret Vault functionality does not include a native .ZIP file type. Users attempting to upload binary archives directly will find no supported category as per product documentation.

In this article, we are sharing a workaround for being able to store the .ZIP file type using the base64 encoding and also describing the decoding of the encoded text file back to .ZIP file format.

Environment

All supported versions of CA PAM till Feb 2026

Resolution

While .ZIP is not a default secret type, you can store any binary file by converting it into a Base64 encoded string. This transforms the binary data into a standard text format that can be stored in a "User Defined" or "Text" secret field. 
The Base64 encoded string needs to be converted back to the .ZIP format for viewing the actual contents.

Note: Storing files as strings in a vault can impact performance. Base64 increases size by roughly 33%

Step-by-Step Implementation: (There is more than one way for doing this, based upon the OS that is being used for converting the .ZIP file to text and back to .ZIP format)
Below is a sample demonstration using Powershell.

Encoding the file for Upload

The following commands need to be executed in the Windows PowerShell:

 

Option A:

[Convert]::ToBase64String([IO.File]::ReadAllBytes("Drive:\Path\To\YourFile.zip")) | Out-File ("Drive:\Path\to\EncodedZip.txt")

Drive means C: or D: or where ever the file is located.

Copy / upload the contents of EncodedZip.txt into the PAM Secret Vault text field.

OR

Option B:

Encode the ZIP file (Windows PowerShell)** Run the following command on your local machine to generate the text string:

PowerShell
$bytes = [System.IO.File]::ReadAllBytes("Drive:\Path\To\YourFile.zip")
$base64 = [System.Convert]::ToBase64String($bytes) 
$base64 | Out-File ("Drive:\Path\To\encoded_zip.txt")

Copy / upload the contents of the encoded_zip.txt into the PAM Secret Vault text field
--------------------------

Decoding the file for Use:

When you retrieve the secret from the vault, save the text to a file and run the commands as per you choice in the PowerShell.

Option A:

$base64 = Get-Content -Path ("Drive:\Path\To\EncodedZip.txt") -Raw
[IO.File]::WriteAllBytes("Drive:\Path\To\RestoredFile.zip", [Convert]::FromBase64String($base64))

OR

Option B:

Decode the string back to ZIP format.

When you need to retrieve the text file from the Secret Vault, copy the string from PAM and save it as secret.txt on your machine, then run the following in the PowerShell

$base64String = Get-Content -Path ("Drive:\Path\To\encoded_zip.txt") -Raw
$bytes = [System.Convert]::FromBase64String($base64String)
[System.IO.File]::WriteAllBytes("Drive:\Path\To\restored_file.zip", $bytes)

Note: Please work with your developers to choose the OS, the programing language / script for performing the encoding and decoding. The above PowerShell scripts are referenced from open source websites.

Additional Information

Symantec Privileged Access Manager Managing Secret Types

 

Microsoft -- PowerShell Documentation