PowerShell: Using the -Decoded parameter in Get-SecureBootUEFI

Introduction

The Get-SecureBootUEFI PowerShell cmdlet retrieves UEFI Secure Boot variables such as PK (Platform Key), KEK (Key Exchange Key), DB (allowed signature database), and DBX (revoked signature database). These variables normally return raw binary data, which can be difficult to interpret directly.

The new -Decoded parameter provides a more accessible view of this information.

What does the -Decoded parameter do?

When you use the -Decoded parameter, the cmdlet displays the contents of Secure Boot databases in a human-readable format. Instead of raw bytes, it decodes and presents the underlying data, including certificates, hashes, and associated metadata stored in UEFI authenticated variables.

With the -Decoded parameter, the output includes readable certificate information such as:

• Subject (for example, Microsoft Windows Production PCA 2011)
• Algorithm and version
• Serial number
• Validity period

This makes it easier to:

• Inspect Secure Boot items such as certificates, hashes, and public keys
• View certificate properties such as subject, issuer, and validity dates
• More easily understand what is trusted in PK, KEK, and DB, and what is revoked in DBX without additional parsing

Example

Command usage in PowerShell:

Command returns:

When to use it

Use the -Decoded parameter when you need to analyze or validate Secure Boot configuration, rather than retrieve their raw values.

Learn more

For full cmdlet details, parameters, and additional examples, see the Get-SecureBootUEFI documentation.

Change log

Change date	Change description
April 30, 2026	Added the descriptive text for the UEFI Secure Boot variables PK, KEK, DB, and DBX in the "Introduction" section Added a "Note" to indicate the -Decoded parameter was added in the April 2026 monthly security update.