PlantUML DiagramPassword Storage Types
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
| Method | Storage format | Reversible? | Recommendation |
|---|---|---|---|
| `enable password` | Cleartext or type 7 | Yes (type 7) | Never use |
| `enable secret` | Type 5 MD5 or type 8/9 | No | Always use |
| `username X password Y` | Cleartext or type 7 | Yes (type 7) | Never use |
| `username X secret Y` | Type 5 or type 8/9 | No | Always use |
| `service password-encryption` | Applies type 7 obfuscation | Yes | Speed bump only |
The pattern is clear: use `secret` everywhere. `enable secret` and `username X secret Y` produce irreversible hashes. The `password` variants store in cleartext or apply type-7 obfuscation, both of which are trivially reversible. `service password-encryption` only obfuscates — it doesn't protect against someone with `show running-config` access.
Modern IOS-XE supports type 8 and type 9 hashes. Type 8 uses PBKDF2-SHA256; type 9 uses scrypt. Both are significantly stronger than type 5 (MD5). Configure them explicitly with `enable algorithm-type scrypt secret MyPassword` or per-user with `username admin algorithm-type sha256 secret MyPass`.
Type 9 (scrypt) is intentionally CPU-intensive to compute — that's the point. It slows down offline brute-force attacks. The trade-off: hashing takes milliseconds instead of microseconds. For login, that's fine. If you're running scripted config with thousands of operations, type 8 (PBKDF2) is a better balance.
! Require minimum password lengthR1(config)# security passwords min-length 12! Configure enable secret with modern hashR1(config)# enable algorithm-type scrypt secret MyStr0ngP@ssw0rd! Configure a local user with strong hashR1(config)# username admin privilege 15 algorithm-type scrypt secret Adm1nP@ss2026! Verify — hashes should show as type 9 (or type 8)R1# show running-config | include secret
The `security passwords min-length 12` command enforces a floor on all newly configured passwords. It won't retroactively fix existing weak passwords — you need to re-set them. Twelve characters minimum is a reasonable baseline for network devices in 2026.
On a lab device, configure `enable secret` and `enable password` with the same value. Look at `show running-config`. The secret shows a hash; the password shows cleartext or type-7. Then run a type-7 decoder (search 'cisco type 7 decoder') on the type-7 hash and see the original password in seconds.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.