Cisco Type 7 Password Decoder

How the decoder works

Paste a Type 7 string from a Cisco IOS configuration, such as the part after password 7 in a line or username entry. The decoder reverses the obfuscation in your browser and shows the original password. It decodes one value at a time, and it doesn't accept whole configuration files.

Cisco describes Type 7 as a Vigenère cipher with a static key. The value starts with a two-digit offset into that key, followed by one pair of hexadecimal digits per character of the password.

How to read the results

• Decoded password is the original text exactly as configured, including case and symbols. It stays hidden until you choose Show password. If it looks garbled, the input probably wasn't Type 7 or was copied incompletely.
• The first two digits are a starting offset into the fixed key, not part of the password. The same password can produce different Type 7 strings for that reason, and they all decode the same way.
• “This looks like a Type 5, 8 or 9 secret” means the value is a one-way hash. There's no original text to recover; reset the password on the device instead.
• If you got a result, assume anyone else could too. Plan to replace the credential.

What the decoder accepts

The value must start with two digits from 00 to 15, followed by complete pairs of hexadecimal characters (0–9, A–F). Anything else, including a first number of 16 or higher, an odd number of characters, or a value with nothing after the first two digits, gets “This isn't a valid Type 7 value” and isn't decoded. A line that mentions secret 5, secret 8 or secret 9, or a value starting with $, is a hash and is refused. More than one line, or more than one password 7 field, is refused too.

Choose Clear when you're done. The input and the result are also cleared when you leave or reload the page.

Stronger options on Cisco devices

Cisco's guidance (Protecting Secrets on Cisco Network Devices) rates Type 0, 5 and 7 as not secure, and Types 6, 8 and 9 as secure. Cisco is removing the option to store reversible credentials as Type 0 or Type 7; Type 6 (AES) is the reversible type it rates secure.

• For the enable password and local user passwords, use secret, not password. A secret is stored as a one-way hash. Cisco's Type 8 (PBKDF2 with SHA-256) and Type 9 (scrypt) are both rated secure; Cisco calls Type 9 “generally considered stronger.”
• On IOS releases that support it, enable algorithm-type picks the hash for the enable secret: scrypt gives Type 9 and sha256 gives Type 8. Cisco's command reference lists it from IOS 15.3(3)M3.
• For credentials the device must be able to read back, such as some pre-shared keys, use Type 6 (AES with a key unique to the device), the reversible type Cisco rates secure. On IOS XE it's enabled with password encryption aes, and the key is set with key config-key password-encrypt. Store that key somewhere safe; you'll need it to move the configuration to another device.

Illustrative example

Illustrative only. This shows the form of a local user stored with a Type 9 (scrypt) secret instead of a Type 7 password. Replace the placeholders, and check your release's documentation (Cisco IOS Security Command Reference) before you use it. This page doesn't generate or apply commands.

! Illustrative only. Placeholders in <angle brackets>.
username <name> algorithm-type scrypt secret <new-password>

Commands and their exact syntax vary by platform and release. Check the configuration guide for your device's software version before changing anything.

Related reference

For passwords and admin accounts more broadly, see the password manager and administrative account sections of the Small Business Cybersecurity Checklist. For Cisco IOS command references, see the Cisco IOS cheat sheets by Jeremy Stretch in the PacketLife library. For limiting who can reach a router's or firewall's admin pages, see Traffic to the router itself in Building a Reliable Home or Small Business Network, and more networking guides under Networking & Wi-Fi.