diff --git a/internal/command/crypto.go b/internal/command/crypto.go
index 5ded26428d..5711006d26 100644
--- a/internal/command/crypto.go
+++ b/internal/command/crypto.go
@@ -16,7 +16,7 @@ type cryptoCode struct {
 	expiry time.Duration
 }
 
-func newCryptoCodeWithExpiry(ctx context.Context, filter preparation.FilterToQueryReducer, typ domain.SecretGeneratorType, alg crypto.Crypto) (*cryptoCode, error) {
+func newCryptoCode(ctx context.Context, filter preparation.FilterToQueryReducer, typ domain.SecretGeneratorType, alg crypto.Crypto) (*cryptoCode, error) {
 	config, err := secretGeneratorConfig(ctx, filter, typ)
 	if err != nil {
 		return nil, err
@@ -39,22 +39,6 @@ func newCryptoCodeWithExpiry(ctx context.Context, filter preparation.FilterToQue
 	return code, nil
 }
 
-func newCryptoCodeWithPlain(ctx context.Context, filter preparation.FilterToQueryReducer, typ domain.SecretGeneratorType, alg crypto.Crypto) (value *crypto.CryptoValue, plain string, err error) {
-	config, err := secretGeneratorConfig(ctx, filter, typ)
-	if err != nil {
-		return nil, "", err
-	}
-
-	switch a := alg.(type) {
-	case crypto.HashAlgorithm:
-		return crypto.NewCode(crypto.NewHashGenerator(*config, a))
-	case crypto.EncryptionAlgorithm:
-		return crypto.NewCode(crypto.NewEncryptionGenerator(*config, a))
-	}
-
-	return nil, "", errors.ThrowInvalidArgument(nil, "V2-NGESt", "Errors.Internal")
-}
-
 func secretGeneratorConfig(ctx context.Context, filter preparation.FilterToQueryReducer, typ domain.SecretGeneratorType) (*crypto.GeneratorConfig, error) {
 	wm := NewInstanceSecretGeneratorConfigWriteModel(ctx, typ)
 	events, err := filter(ctx, wm.Query())
diff --git a/internal/command/email.go b/internal/command/email.go
index b9e24ccc46..2a1eb563ed 100644
--- a/internal/command/email.go
+++ b/internal/command/email.go
@@ -18,5 +18,5 @@ func (e *Email) Validate() error {
 }
 
 func newEmailCode(ctx context.Context, filter preparation.FilterToQueryReducer, alg crypto.EncryptionAlgorithm) (*cryptoCode, error) {
-	return newCryptoCodeWithExpiry(ctx, filter, domain.SecretGeneratorTypeVerifyEmailCode, alg)
+	return newCryptoCode(ctx, filter, domain.SecretGeneratorTypeVerifyEmailCode, alg)
 }
diff --git a/internal/command/phone.go b/internal/command/phone.go
index eba2777df6..370ab947ec 100644
--- a/internal/command/phone.go
+++ b/internal/command/phone.go
@@ -14,5 +14,5 @@ type Phone struct {
 }
 
 func newPhoneCode(ctx context.Context, filter preparation.FilterToQueryReducer, alg crypto.EncryptionAlgorithm) (*cryptoCode, error) {
-	return newCryptoCodeWithExpiry(ctx, filter, domain.SecretGeneratorTypeVerifyPhoneCode, alg)
+	return newCryptoCode(ctx, filter, domain.SecretGeneratorTypeVerifyPhoneCode, alg)
 }
diff --git a/internal/command/project_application.go b/internal/command/project_application.go
index dfab284831..1e6676a108 100644
--- a/internal/command/project_application.go
+++ b/internal/command/project_application.go
@@ -16,8 +16,8 @@ type AddApp struct {
 	Name      string
 }
 
-func newAppClientSecret(ctx context.Context, filter preparation.FilterToQueryReducer, alg crypto.HashAlgorithm) (value *crypto.CryptoValue, plain string, err error) {
-	return newCryptoCodeWithPlain(ctx, filter, domain.SecretGeneratorTypeAppSecret, alg)
+func newAppClientSecret(ctx context.Context, filter preparation.FilterToQueryReducer, alg crypto.HashAlgorithm) (*cryptoCode, error) {
+	return newCryptoCode(ctx, filter, domain.SecretGeneratorTypeAppSecret, alg)
 }
 
 func (c *Commands) ChangeApplication(ctx context.Context, projectID string, appChange domain.Application, resourceOwner string) (*domain.ObjectDetails, error) {
diff --git a/internal/command/project_application_api.go b/internal/command/project_application_api.go
index 7354e5f99e..b54acaace1 100644
--- a/internal/command/project_application_api.go
+++ b/internal/command/project_application_api.go
@@ -44,10 +44,11 @@ func (c *Commands) AddAPIAppCommand(app *addAPIApp, clientSecretAlg crypto.HashA
 			}
 
 			if app.AuthMethodType == domain.APIAuthMethodTypeBasic {
-				app.ClientSecret, app.ClientSecretPlain, err = newAppClientSecret(ctx, filter, clientSecretAlg)
+				code, err := newAppClientSecret(ctx, filter, clientSecretAlg)
 				if err != nil {
 					return nil, err
 				}
+				app.ClientSecret, app.ClientSecretPlain = code.value, code.plain
 			}
 
 			return []eventstore.Command{
diff --git a/internal/command/project_application_oidc.go b/internal/command/project_application_oidc.go
index 44efd279a1..dd9ed3381e 100644
--- a/internal/command/project_application_oidc.go
+++ b/internal/command/project_application_oidc.go
@@ -77,10 +77,11 @@ func (c *Commands) AddOIDCAppCommand(app *addOIDCApp, clientSecretAlg crypto.Has
 			}
 
 			if app.AuthMethodType == domain.OIDCAuthMethodTypeBasic || app.AuthMethodType == domain.OIDCAuthMethodTypePost {
-				app.ClientSecret, app.ClientSecretPlain, err = newAppClientSecret(ctx, filter, clientSecretAlg)
+				code, err := newAppClientSecret(ctx, filter, clientSecretAlg)
 				if err != nil {
 					return nil, err
 				}
+				app.ClientSecret, app.ClientSecretPlain = code.value, code.plain
 			}
 
 			return []eventstore.Command{
diff --git a/internal/command/user.go b/internal/command/user.go
index 2eead648a0..f66119dcde 100644
--- a/internal/command/user.go
+++ b/internal/command/user.go
@@ -440,7 +440,7 @@ func ExistsUser(ctx context.Context, filter preparation.FilterToQueryReducer, id
 }
 
 func newUserInitCode(ctx context.Context, filter preparation.FilterToQueryReducer, alg crypto.EncryptionAlgorithm) (*cryptoCode, error) {
-	return newCryptoCodeWithExpiry(ctx, filter, domain.SecretGeneratorTypeInitCode, alg)
+	return newCryptoCode(ctx, filter, domain.SecretGeneratorTypeInitCode, alg)
 }
 
 func userWriteModelByID(ctx context.Context, filter preparation.FilterToQueryReducer, userID, resourceOwner string) (*UserWriteModel, error) {