Cisco Type 7 Decoder
Type 7 is obfuscation, not encryption: a fixed-key Vigenère that any tool reverses in a millisecond. This page exists for the moment you inherit a config and need the enable password back, not as a security feature. Everything runs in your browser.
| Line | Type 7 | Decoded |
|---|
Encodefor lab configs only
Type 7
What to use instead
| Type | Algorithm | Verdict |
|---|---|---|
| 0 | plain text | never |
| 7 | fixed-key XOR | reversible, this page |
| 5 | MD5 crypt | legacy, crackable offline |
| 4 | single SHA-256, no salt | worse than 5, avoid |
| 8 | PBKDF2-SHA256 | good |
| 9 | scrypt | best |
! Store the enable secret and local users with scrypt
enable algorithm-type scrypt secret S3cr3tPassw0rd
username admin algorithm-type scrypt secret S3cr3tPassw0rd
! Hide any remaining type 0 strings as type 7 (still not safe, but not plain text)
service password-encryptionWarning
service password-encryption only produces type 7. Anything that must stay secret (enable, local users, TACACS/RADIUS keys where the platform allows) should be a type 8/9 secret or live in a key chain with key-string 8|9.
Last updated on