diff --git a/mRemoteNG.Specs/StepDefinitions/CredentialRepositorySteps.cs b/mRemoteNG.Specs/StepDefinitions/CredentialRepositorySteps.cs
index 659cad1a..999e9ca7 100644
--- a/mRemoteNG.Specs/StepDefinitions/CredentialRepositorySteps.cs
+++ b/mRemoteNG.Specs/StepDefinitions/CredentialRepositorySteps.cs
@@ -1,5 +1,6 @@
 using System.Security;
 using mRemoteNG.Credential;
+using mRemoteNG.Security;
 using mRemoteNG.Specs.Utilities;
 using NUnit.Framework;
 using TechTalk.SpecFlow;
@@ -10,15 +11,12 @@ namespace mRemoteNG.Specs.StepDefinitions
     public class CredentialRepositorySteps
     {
         private ICredentialRepository _credentialRepository;
+        private readonly SecureString _key = "somePassword".ConvertToSecureString();
 
         [Given(@"I have a credential repository")]
         public void GivenIHaveACredentialRepository()
         {
-            var utilityFactory = new XmlCredentialRepoBuilder();
-            var credentialXml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>" +
-                    "<Credentials EncryptionEngine=\"AES\" BlockCipherMode=\"GCM\" KdfIterations=\"1000\" SchemaVersion=\"1.0\">" +
-                    "</Credentials>";
-            utilityFactory.XmlFileContent = credentialXml;
+            var utilityFactory = new XmlCredentialRepoBuilder {EncryptionKey = _key};
             _credentialRepository = utilityFactory.BuildXmlCredentialRepo();
         }
 
@@ -33,7 +31,7 @@ namespace mRemoteNG.Specs.StepDefinitions
         [Given(@"The credential repository is loaded")]
         public void GivenTheCredentialRepositoryIsLoaded()
         {
-            _credentialRepository.LoadCredentials(new SecureString());
+            _credentialRepository.LoadCredentials(_key);
             Assert.That(_credentialRepository.IsLoaded);
         }
 
@@ -46,7 +44,7 @@ namespace mRemoteNG.Specs.StepDefinitions
         [When(@"I click load")]
         public void WhenIClickLoad()
         {
-            _credentialRepository.LoadCredentials(new SecureString());
+            _credentialRepository.LoadCredentials(_key);
         }
 
         [Then(@"the credential repository is loaded")]
diff --git a/mRemoteNG.Specs/Utilities/CredRepoXmlFileBuilder.cs b/mRemoteNG.Specs/Utilities/CredRepoXmlFileBuilder.cs
new file mode 100644
index 00000000..4c777abe
--- /dev/null
+++ b/mRemoteNG.Specs/Utilities/CredRepoXmlFileBuilder.cs
@@ -0,0 +1,12 @@
+namespace mRemoteNG.Specs.Utilities
+{
+    public class CredRepoXmlFileBuilder
+    {
+        public string Build(string authHeader)
+        {
+            return "<?xml version=\"1.0\" encoding=\"utf-8\"?>" +
+                    $"<Credentials EncryptionEngine=\"AES\" BlockCipherMode=\"GCM\" KdfIterations=\"1000\" Auth=\"{authHeader}\" SchemaVersion=\"1.0\">" +
+                    "</Credentials>";
+        }
+    }
+}
\ No newline at end of file
diff --git a/mRemoteNG.Specs/Utilities/XmlCredentialRepoBuilder.cs b/mRemoteNG.Specs/Utilities/XmlCredentialRepoBuilder.cs
index 27d1f62a..a49432fb 100644
--- a/mRemoteNG.Specs/Utilities/XmlCredentialRepoBuilder.cs
+++ b/mRemoteNG.Specs/Utilities/XmlCredentialRepoBuilder.cs
@@ -1,5 +1,4 @@
-using System.Collections.Generic;
-using System.Security;
+using System.Security;
 using mRemoteNG.Config;
 using mRemoteNG.Config.DataProviders;
 using mRemoteNG.Config.Serializers.CredentialSerializer;
@@ -14,11 +13,12 @@ namespace mRemoteNG.Specs.Utilities
     {
         public SecureString EncryptionKey { get; set; } = "someKey1".ConvertToSecureString();
         public ICryptographyProvider CryptographyProvider { get; set; } = new AeadCryptographyProvider();
-        public string XmlFileContent { get; set; } = "";
 
         public ICredentialRepository BuildXmlCredentialRepo()
         {
-            var dataProvider = new InMemoryStringDataProvider(XmlFileContent);
+            var xmlFileBuilder = new CredRepoXmlFileBuilder();
+            var xmlFileContent = xmlFileBuilder.Build(CryptographyProvider.Encrypt("someheaderdata", EncryptionKey));
+            var dataProvider = new InMemoryStringDataProvider(xmlFileContent);
             var encryptor = new XmlCredentialPasswordEncryptorDecorator(
                 CryptographyProvider,
                 new XmlCredentialRecordSerializer()
diff --git a/mRemoteNG.Specs/mRemoteNG.Specs.csproj b/mRemoteNG.Specs/mRemoteNG.Specs.csproj
index ce176e74..3ba0e26f 100644
--- a/mRemoteNG.Specs/mRemoteNG.Specs.csproj
+++ b/mRemoteNG.Specs/mRemoteNG.Specs.csproj
@@ -61,6 +61,7 @@
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="StepDefinitions\CredentialRepositoryListSteps.cs" />
     <Compile Include="StepDefinitions\CredentialRepositorySteps.cs" />
+    <Compile Include="Utilities\CredRepoXmlFileBuilder.cs" />
     <Compile Include="Utilities\XmlCredentialRepoBuilder.cs" />
   </ItemGroup>
   <ItemGroup>
diff --git a/mRemoteNGTests/Config/Serializers/CredentialSerializers/XmlCredentialPasswordDecryptorDecoratorTests.cs b/mRemoteNGTests/Config/Serializers/CredentialSerializers/XmlCredentialPasswordDecryptorDecoratorTests.cs
index 52640dce..6dfd1309 100644
--- a/mRemoteNGTests/Config/Serializers/CredentialSerializers/XmlCredentialPasswordDecryptorDecoratorTests.cs
+++ b/mRemoteNGTests/Config/Serializers/CredentialSerializers/XmlCredentialPasswordDecryptorDecoratorTests.cs
@@ -23,19 +23,27 @@ namespace mRemoteNGTests.Config.Serializers.CredentialSerializers
         [Test]
         public void OutputedCredentialHasDecryptedPassword()
         {
-            var xml = GenerateXml();
+            var xml = GenerateCredentialXml();
             var output = _sut.Deserialize(xml, _decryptionKey);
             Assert.That(output.First().Password.ConvertToUnsecureString(), Is.EqualTo(_unencryptedPassword));
         }
 
+        [Test]
+        public void DecryptionThrowsExceptionWhenAuthHeaderNotFound()
+        {
+            var xml = GenerateCredentialXml(false);
+            Assert.Throws<EncryptionException>(() => _sut.Deserialize(xml, _decryptionKey));
+        }
 
-        private string GenerateXml()
+
+        private string GenerateCredentialXml(bool includeAuthHeader = true)
         {
             var cryptoProvider = new AeadCryptographyProvider();
+            var authHeader = includeAuthHeader ? $"Auth=\"{cryptoProvider.Encrypt("someheader", _decryptionKey)}\"" : "";
             var encryptedPassword = cryptoProvider.Encrypt(_unencryptedPassword, _decryptionKey);
             return
                 "<?xml version=\"1.0\" encoding=\"utf-8\"?>" +
-                $"<Credentials EncryptionEngine=\"{cryptoProvider.CipherEngine}\" BlockCipherMode=\"{cryptoProvider.CipherMode}\" KdfIterations=\"{cryptoProvider.KeyDerivationIterations}\" SchemaVersion=\"1.0\">" +
+                $"<Credentials EncryptionEngine=\"{cryptoProvider.CipherEngine}\" BlockCipherMode=\"{cryptoProvider.CipherMode}\" KdfIterations=\"{cryptoProvider.KeyDerivationIterations}\" {authHeader} SchemaVersion=\"1.0\">" +
                     $"<Credential Id=\"ce6b0397-d476-4ffe-884b-dbe9347a88a8\" Title=\"New Credential\" Username=\"asdfasdf\" Domain=\"\" Password=\"{encryptedPassword}\" />" +
                 "</Credentials>";
         }