Calling to Marshal.PtrToStringBSTR(ptr) creates a System.String that has the same content with ss. You end up having another copy of the password that has all the problem that you try to avoid in the first place. It defeats the purpose of having SecureString.