Cisco IOS service password-encryption Command

Learn how Cisco IOS service password-encryption creates reversible Type 7 password obfuscation, how to verify it, and why enable secret and AAA are more secure.

The Cisco IOS service password-encryption command applies reversible Cisco Type 7 obfuscation to supported passwords displayed in the device configuration. Its purpose is to prevent casual viewing of readable passwords, not to provide strong protection for credentials.

This command is useful in training labs and some legacy environments, but a configuration containing Type 7 values must still be treated as sensitive. Type 7 is reversible and should not be confused with a modern password hash or secure encryption method.

What service password-encryption Does

A plaintext password is a password shown as readable text, such as password LabConsolePassword. Without additional protection, some Cisco IOS password commands can appear this way in show running-config.

When the global command is enabled, IOS changes supported cleartext password entries to Cisco Type 7 values. The value is difficult to read casually, but it can be reversed by someone who knows the encoding method or has suitable tools.

Syntax and Configuration Mode

Enter the command from global configuration mode:

Router> enable
Router# configure terminal
Router(config)# service password-encryption

The command has no arguments. It is a global configuration command, so it affects applicable password configuration throughout the device rather than only the current console or VTY line.

To disable the feature, use the no form:

Router(config)# no service password-encryption

Verify whether the feature is configured by inspecting the running configuration:

Router# show running-config

Look for service password-encryption in the global portion of the output. The running configuration is the active configuration held in memory. The startup configuration is the saved configuration used after a restart; save changes only after testing them.

Which Passwords Can Be Affected?

The command commonly affects cleartext passwords used by supported IOS features, including console, VTY, and AUX line passwords, local usernames configured with legacy password syntax, and the legacy enable password command.

When enabled, it affects applicable existing cleartext entries and applicable passwords entered afterward. Exact behavior can vary by IOS release, platform, feature, and command syntax. A password or credential displayed by a feature-specific secret mechanism may not be changed by this command.

Credential Location — Example — Typical Effect — Preferred Alternative

Console, AUX, and VTY lines — line console 0, line aux 0, or line vty with password — Supported cleartext line passwords are typically represented as Type 7 — Use local secret-based authentication or AAA, and manage remote access with secure protocols.

Legacy privileged access — enable password — The password can be represented as Type 7 when the service is enabled — Replace it with enable secret.

Local username — username NAME password VALUE — Supported legacy password entries are typically obfuscated — Use username NAME secret VALUE or a stronger supported secret format.

Enable secret — enable secret VALUE — It uses its own secret or hash mechanism and is not converted to Type 7 by this command — Keep using enable secret, with a stronger algorithm where supported.

AAA or external authentication — Local, RADIUS, or TACACS+ authentication — Credentials are handled by the selected authentication system rather than by this global Type 7 feature — Use centralized AAA where appropriate.

Lab Example: Console and VTY Passwords

First configure line passwords in a controlled lab. The login command tells IOS to require the configured line password.

Router(config)# line console 0
Router(config-line)# password LabConsolePassword
Router(config-line)# login
Router(config-line)# exit
Router(config)# line vty 0 4
Router(config-line)# password LabVtyPassword
Router(config-line)# login
Router(config-line)# end
Router# show running-config

Before enabling the service, a supported configuration may contain readable entries similar to these:

line con 0
 password LabConsolePassword
 login
!
line vty 0 4
 password LabVtyPassword
 login

Enable the global command and inspect the configuration again:

Router# configure terminal
Router(config)# service password-encryption
Router(config)# end
Router# show running-config

The same entries may now appear with a Type 7 indicator and an encoded value, for example:

line con 0
 password 7 0822455D0A16170A
 login
!
line vty 0 4
 password 7 030752180500

The exact encoded strings vary with the password and IOS implementation. A number 7 before the value typically identifies Cisco Type 7 encoding.

Type 7 Versus Hash-Based Secrets

A password hash is a one-way representation used to verify a password without storing a directly recoverable copy. Type 7 is different: it is reversible encoding. Therefore, Type 7 provides concealment from casual observation but not strong credential protection.

Method — Typical Use — Stored or Displayed Form — Reversible? — Recommendation

Plaintext password without the service — Legacy line or username password — Readable text — Yes — Avoid outside a temporary lab.

Type 7 from service password-encryption — Supported legacy password entries — Usually shown with type number 7 and an encoded string — Yes — Legacy compatibility or training only; treat as sensitive.

Legacy enable password — Privileged EXEC authentication — May be plaintext or Type 7 depending on configuration — Yes — Replace with enable secret.

Enable secret — Preferred privileged EXEC authentication — Secret or hash representation — Designed for verification rather than Type 7 reversal — Use this instead of enable password.

Type 8 and Type 9 secret formats — Supported local secrets on suitable IOS releases — Stronger secret or hash formats — Generally treated as one-way password hashes — Prefer when supported, subject to platform and IOS documentation.

Enable Password Versus Enable Secret

Privileged EXEC mode is the administrative mode commonly reached with the enable command. Cisco IOS provides two commonly tested configuration commands for protecting entry to this mode.

enable password is the legacy method. It may be exposed as plaintext or Type 7, so it is not the preferred choice.

enable secret is preferred. It uses a secret or password-hashing mechanism rather than the Type 7 mechanism produced by service password-encryption. If both commands are configured, enable secret takes precedence when IOS authenticates access to privileged EXEC mode.

Router(config)# enable password LegacyLabPassword
Router(config)# enable secret StrongerLabSecret
Router# show running-config

Use this comparison only in a controlled lab. In production, remove obsolete credentials after confirming that the intended access method works.

Local Usernames and Stronger Secrets

A local username configured with legacy password syntax can also be affected when the service is enabled:

Router(config)# username labuser password LabUserPassword
Router# show running-config

On platforms and IOS versions that support it, prefer a secret-based form:

Router(config)# username labuser secret AStrongerLabSecret

The exact available secret algorithms and syntax depend on the device and IOS version. Type 8 and Type 9 formats are examples of stronger supported secret formats, but administrators should verify platform support before using them.

Verification and Interpretation

Use show running-config to inspect relevant entries:

Router# show running-config

Review the global section, console and VTY sections, AUX lines where present, local username entries, and enable credentials. A value such as password 7 ... or secret 7 ... indicates a Type 7 representation, although the exact display depends on the feature and IOS release.

Output does not reveal every credential in the same way. Results depend on the configured feature, command syntax, privilege level, IOS release, and whether the credential is a password, secret, hash, or externally authenticated account.

What Happens When the Command Is Disabled?

The command below disables automatic Type 7 obfuscation for applicable future cleartext password entries:

Router(config)# no service password-encryption
Router# show running-config

Disabling it does not decode existing Type 7 values or turn them back into readable passwords. Existing encoded entries normally remain encoded.

If an administrator needs to change an existing legacy entry to another form, the known password generally must be entered again using the intended command. If the password is unknown, do not attempt to recover it from the configuration; reset it through an authorized administrative procedure.

For example, after disabling the service, reenter a test line password only if the lab is intentionally demonstrating the behavior:

Router(config)# line console 0
Router(config-line)# password NewLabPassword
Router(config-line)# end
Router# show running-config

Modern Credential-Protection Recommendations

Use enable secret instead of enable password.
Use Type 8 or Type 9 secret formats when supported by the device and IOS version.
Use AAA, meaning Authentication, Authorization, and Accounting, with centralized RADIUS or TACACS+ services where appropriate.
Use secure management protocols, such as SSH rather than insecure plaintext remote-management methods.
Restrict access to running and startup configurations, configuration repositories, and backups.
Give administrators only the device and configuration access required for their roles.
Treat any configuration containing Type 7 values as sensitive and sanitize credentials before sharing it.
Retain service password-encryption for legacy or training requirements only; it is not a replacement for strong password design.

Troubleshooting

A password is still readable

Confirm the exact command used to create the credential. The feature may not affect that credential type in the current IOS release, or the displayed item may use separate secret-handling behavior. Check the platform and IOS documentation, then use the feature's recommended secret or AAA mechanism.

The configuration contains a number 7

A number 7 followed by an unreadable-looking string typically means Cisco Type 7 reversible encoding. Treat the configuration as sensitive and replace legacy password use with secret-based authentication where possible.

Removing the command did not reveal old passwords

This is expected. The no form stops automatic encoding for applicable future entries; it does not rewrite existing Type 7 values. Reenter a known password using the desired method if a conversion is required.

Privileged EXEC accepts a different password than expected

Inspect the configuration for both enable password and enable secret. If both exist, enable secret takes precedence. Use enable secret as the intended credential and remove the obsolete enable password after validating access.

A team wants to distribute the configuration backup

Do not assume Type 7 makes the backup safe. Restrict backup access, protect storage and transfer channels, and sanitize credentials before sharing. Configuration files can also expose topology, addressing, usernames, and operational details.

Saving a Tested Configuration

After testing access and confirming the intended credential method, save the active configuration if the change should survive a reboot:

Router# copy running-config startup-config

Remember that saving the configuration copies the current running configuration to startup configuration; it does not strengthen Type 7 values.

Exam-Relevant Summary

service password-encryption is a global configuration command.
It obfuscates supported plaintext passwords using Cisco Type 7.
Type 7 is reversible and is not strong encryption or a one-way hash.
It commonly affects console, VTY, AUX, local legacy username passwords, and enable password entries, subject to IOS and platform behavior.
no service password-encryption stops automatic encoding for applicable future entries but does not decode existing Type 7 values.
enable secret is preferred over enable password.
When both are configured, enable secret takes precedence for privileged EXEC authentication.
Use stronger supported secret formats and AAA when appropriate.

For related IOS password configuration practice, see Configure Passwords in IOS.