Why Cisco Type 7 Passwords Give You No Real Protection
2026-10-14 · 5 min read
Figure 1: Type 7 is obfuscation, not encryption
The claim and the reality
Turn on service password-encryption in Cisco IOS and the plain passwords in your config change into strings like 094F471A1A0A. They certainly look scrambled. The trouble is that turning them back into the original text needs no secret at all, so treating a Type 7 value as protected is a mistake that has burned a lot of networks.
This post explains what the format actually does and where it still has a small, honest use.
What Type 7 really is
Type 7 is not encryption in any meaningful sense. It is a simple reversible transform: each character of your password is combined, using XOR, with bytes from a fixed key that Cisco built into the software years ago. That key is public knowledge and has been printed in blog posts, scripts and textbooks for over two decades.
The encoded string carries two parts. The first two digits are an offset that says where to start reading the built-in key. Everything after is the password, byte by byte, XORed against the key and written as hex. Because the key is known and the offset is right there in the output, undoing the whole thing is arithmetic a pocket calculator could manage.
You can watch how little stands in the way with the Cisco Type 7 decoder. Paste a value and the original appears at once, no password or key required.
Why it exists at all
Cisco never claimed this was strong. Its only job is to stop a passing glance from catching a plaintext password, for example when a config is printed on paper or shown on a projector during a meeting. Against a shoulder looking at a screen, it helps a little. Against anyone who can copy the text, it does nothing.
So the feature has one narrow purpose: hiding passwords from casual eyes in the same room. The moment the config leaves that room, the protection is gone.
Where the real danger starts
Network configs travel far more than people expect. They sit in backups, get pulled over TFTP, land in ticket attachments, get pasted into chat, and far too often end up in a Git repository. Every one of those copies carries the Type 7 string, and every string reveals its password to anyone who finds it.
Worse, admins reuse passwords. A Type 7 value lifted from a forgotten backup can unlock the live router, and sometimes the firewall and the switch next to it as well. Treat a Type 7 secret exactly as you would treat the password written in the clear, because that is effectively what it is.
What to use instead
Cisco offers hash types that are built for storing secrets, and those are the ones to rely on:
- Type 8 applies PBKDF2 with SHA-256, a slow, salted hash meant for passwords.
- Type 9 uses scrypt, which also demands memory per guess and resists cracking hardware even better.
For an enable secret or a local user, choose Type 8 or Type 9. Steer clear of the old Type 4, which was pulled after a flaw, and never lean on Type 7 for anything that matters. Where a device still forces Type 7 for a particular setting, such as some tunnel or routing keys, assume the value is readable and lock down the config files instead.
The takeaway
Type 7 is a privacy curtain, not a vault. It keeps a password off a projector and nothing more. Store your real secrets as Type 8 or Type 9, guard every copy of your configs, and if you ever need proof of how thin Type 7 is, the decoder above will show you in a single click.