Cisco Type 7 Password Decoder

How to Use

1. Find the hash in your config

On the device, run show running-config (or open a saved config backup) and look for lines that contain password 7:

2. Copy only the hash

Copy the characters after the 7 and leave the 7 itself out. From password 7 072C285F4D06, copy 072C285F4D06.

3. Paste and decode

Paste into the box above and click Decode Password (or press Ctrl/Cmd + Enter). You can paste many hashes, one per line, to decode a whole config in one go.

4. Check the steps

For a single hash, click Show how this was decoded. In batch mode, each successful row has its own Show steps button, plus a Show all steps button at the top. Each breakdown lists every encrypted byte, the XLAT value used, the XOR operation and the resulting character.

How Cisco Type 7 Works

Type 7 was designed to stop a password from being read at a glance in a config file, not to resist anyone who knows the method. It XORs each character of the password with a byte from a fixed 53-byte table (often called the XLAT table), and the table is the same on every Cisco IOS device.

The three parts of a Type 7 hash

• Seed (first two digits): a decimal number that says where in the XLAT table to start. IOS normally generates seeds from 00 to 15; this decoder accepts any seed from 00 to 52.
• Encrypted bytes (the rest): two hex digits per password character.
• Key stream: byte n of the password is XORed with XLAT[(seed + n) mod 53], so the index advances by one for each character.

Worked example: 072C285F4D06

The seed is 07, so decoding starts at XLAT[7]. The remaining bytes are 2C 28 5F 4D 06.

Result: Cisco. The same password can produce different hashes, because a different seed changes the whole key stream. For example, 070C285F4D06 decodes to lowercase cisco.

Why Type 7 is weak

• Fixed, public key material: the XLAT table is identical on every device and has been documented for decades.
• Reversible by design: XOR with a known key stream can be undone instantly. There is no secret to guess.
• No salt or work factor: decoding takes a few operations per character, however long the password is.
• No integrity check: a corrupted hash may still decode to garbage, which is why this tool rejects results with non-printable characters.

What to use instead

When You'll Actually Need This

Most engineers don't go looking for Type 7 hashes. They inherit them.

• Taking over a network: an old config has a shared password 7 line and nobody remembers the credential.
• Restoring from backup: decoding the hash confirms which credential a restore is about to bring back.
• Migrating to Type 8/9: the new hash needs a plaintext, so recover it, then rotate it. The legacy config audit guide covers the order of work.
• Compliance reviews: auditors (PCI-DSS, ISO 27001) flag Type 7 strings; decoding shows what is actually exposed.

Related Guides & Tools

• Migrating from Cisco Type 7 to Type 9: a phased process for retiring weak password storage
• Encoding vs. Encryption vs. Hashing: why Type 7 is neither secure encryption nor a hash
• Cisco Password Security Checklist: commands and checks for auditing password hygiene
• Auditing Legacy Network Configs: what to check first when you inherit a network
• IPv4 Subnet Calculator: network, broadcast and host range from an IP and CIDR or mask

See every guide on the Articles page.

Frequently Asked Questions