This Cisco type 7 decoder reveals passwords stored in type 7 format in IOS configs and identifies the other password formats, so you can audit configurations and see which secrets are actually protected. It runs entirely in your browser: nothing you type is sent to our server.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
Why a Cisco type 7 decoder works: type 7 is not encryption
service password-encryption only scrambles passwords with a fixed, publicly known key (Vigenère-style). Anyone with a copy of the config can read them, which is why this tool exists. Treat any config that leaves your control as leaking its type 7 passwords.
Cisco password types
| Type | What it is | Safe? |
|---|---|---|
| 0 | Plain text | No |
| 4 | Flawed SHA-256 scheme, deprecated | No |
| 5 | MD5-crypt ($1$) | Weak |
| 6 | AES with a device master key | For keys that must be reversible |
| 7 | Reversible obfuscation | No |
| 8 | PBKDF2-SHA256 ($8$) | Yes |
| 9 | scrypt ($9$) | Yes, best |
What to use instead
enable algorithm-type scrypt secret NEW-PASSWORD
username admin privilege 15 algorithm-type scrypt secret NEW-PASSWORDAuditing a config with the Cisco type 7 decoder
- Export the running configuration from each device (
show running-config) or open your config backups. - Paste the lines with
password 7orsecretinto the decoder. It reveals type 7 passwords and names every other type. - Treat every password that decodes as exposed: change it, and store new secrets as type 8 (PBKDF2-SHA256) or type 9 (scrypt), for example
enable algorithm-type scrypt secret NEWorusername admin algorithm-type scrypt secret NEW. - Keep
service password-encryptionon only to stop someone reading passwords over your shoulder; it is not protection.
Common mistakes:
- Posting configurations with type 7 lines in tickets, chats or forums.
- Treating type 5 as safe: it is salted MD5 and can be cracked offline.
- Forgetting secrets that type 8 and type 9 do not cover, such as SNMP community strings and some keys, which may still be in plain text or type 7.
Related tools and guides: Cisco ACL generator, password generator, hash generator, VLAN config generator.
How we checked it
We verified the decoder on 11-12 October 2026 with three published type 7 strings for the password “cisco” (0822455D0A16, 02050D480809, 060506324F41) against an independent implementation, and checked that encoding and decoding round-trip.
Cisco’s own hardening advice on password types: the Cisco Guide to Harden Cisco IOS Devices.
Frequently asked questions
Can Cisco type 7 passwords be decrypted?
Yes, instantly. The algorithm and its key are public. That is why type 7 should only be used where the device itself needs the clear text and nothing better is supported.
Can type 5, 8 or 9 passwords be decoded?
No. They are one-way hashes. They can only be guessed by brute force, which is slow for type 8 and 9.
Should I use service password-encryption?
Yes, but only to hide passwords from someone glancing at a screen. Use secret with type 9 for all login passwords.