Cisco Type 7 Password Decryption

Features

• Both directions: config string → plaintext, plaintext → config string
• Paste a whole config line — the `password 7` prefix, quotes and surrounding whitespace are stripped
• Choose the starting offset when encrypting (Cisco picks 0–15 at random)
• Uses the full 53-byte key, so passwords longer than 26 characters still decode correctly
• Non-ASCII plaintext is handled as UTF-8 bytes and round-trips losslessly

How to use

1. Copy the string out of the device configuration (the `password 7` part can come along)
2. Paste it into the box; the plaintext appears immediately
3. To go the other way, switch the direction to Encrypt
4. Click Copy to take the result

FAQ

Is Type 7 the same as `enable secret`?

No, and the security difference is enormous. `enable secret` in a config (Type 5) is a one-way hash — MD5 historically, now scrypt or bcrypt — and cannot be reversed. `password 7` (Type 7) is a reversible XOR, so anyone with the configuration recovers the password. The reversible form survived because protocols like CHAP need the cleartext to compute a digest, and the price is that it offers no protection at all. Seeing `password 7` should tell you that device's config carries a plaintext password.

Why do some online tools fail on long passwords?

Because they use only the first 26 bytes of the key. The complete key is 53 bytes: `dsfd;kfoA,.iyewrkldJKDHSUBsgvca69834ncxv9873254k;fg87`. With 26 bytes, short passwords still decode correctly (the index never reaches 26), which is why the bug hides so well — until someone decodes a password longer than 26 characters and everything from the 27th onward comes out wrong. This tool uses the full key, with a test aimed squarely at that boundary.

What is the "offset" when encrypting?

It is the starting point into the key, written as the two decimal digits at the front of the ciphertext. Cisco picks a random value from 0 to 15, which is why the same password encodes differently on every device — it provides no security whatsoever, it merely makes several passwords in one config look different from each other. To reproduce a specific device's output you need the offset it used, and that value sits in the first two characters of the ciphertext.