Cisco IOS Password Types 0, 7, 5, 8, and 9

Every stored password in a Cisco configuration carries a leading digit that names the algorithm protecting it. Type 0 is clear text, type 7 is a reversible obfuscation that anyone can undo, and types 5, 8, and 9 are one-way hashes using MD5, PBKDF2, and scrypt respectively. Reading that digit tells you immediately whether a leaked configuration file has handed over a usable password or a value nobody can turn back.

Reading the digit

The number sits between the command keyword and the stored value, and the three examples below come from three different configuration levels: global for the enable secret and the username, and line configuration for the console password, a distinction the IOS prompt hierarchy makes visible while you type.

enable secret 9 $9$xR7kQm2VbN0pLe$Hs3
username helpdesk password 7 104D000A0618
line console 0
 password 7 060506324F41

Two of those three values are recoverable. The type 9 secret is not, no matter who obtains the file. The two type 7 values are, in seconds, with tools that have been public for decades.

Type	Algorithm	Direction	Where it appears	Verdict
0	none, stored as typed	plain text	enable password, line passwords, username ... password	no protection at all
7	Vigenère-style cipher with a published key	reversible	same commands, after service password-encryption	obfuscation only
5	salted MD5	one way	enable secret, username ... secret	legacy, crackable offline
8	PBKDF2 with SHA-256	one way	enable algorithm-type sha256 secret	strong
9	scrypt	one way	enable algorithm-type scrypt secret	strongest available

Type 4 briefly existed as an unsalted SHA-256 value and was withdrawn after the missing salt and low iteration count were found to weaken it. Current images will not generate one.

Type 7 and service password-encryption

service password-encryption is a single global command that converts clear-text values already in the configuration into type 7 form and applies the same encoding to values entered afterwards.

R1(config)# service password-encryption

The algorithm is a Vigenère variant whose key was published long ago, and it has to be reversible because the device itself must recover the original string to compare against what a user types. That design constraint is the whole story: a scheme the router can undo is a scheme an attacker can undo.

The genuine value is narrow and real. It keeps a password off a projected screen during a change window, out of a screenshot pasted into a ticket, and away from someone reading over a shoulder in an open office. The moment the configuration text leaves the device, in an email, a repository, or a support case, the protection is gone. That includes routine configuration backups pushed to a TFTP server, which travel unauthenticated and in clear text and land in a file anyone with access to the server can read.

Three follow-on facts get tested:

• The command does not upgrade anything to the hashing algorithm used by enable secret. It only takes clear text and makes it unreadable at a glance.
• It does not remove values from the configuration. They are still present, rendered differently.
• Entering no service password-encryption does not restore clear text. Existing type 7 values stay type 7 until someone reconfigures each one; only newly entered passwords are stored as type 0 again.

It also has no effect on values that were never clear text in the first place. An enable secret is already a hash, so password encryption leaves it untouched.

Types 5, 8, and 9

A hash is stored, the entered password is hashed the same way at login, and the two results are compared. Nothing in the stored value can be run backwards.

Type 5 uses salted MD5 and is recognisable by its $1$ prefix. The salt defeats precomputed tables, but MD5 is fast, and fast is exactly the wrong property for a password hash because a graphics card can test enormous numbers of candidates per second. It remains extremely common in older configurations.

Type 8 uses PBKDF2 with SHA-256 and a high iteration count, which makes each guess expensive in CPU time.

Type 9 uses scrypt, which is deliberately memory-hard as well as slow, so purpose-built cracking hardware gains far less advantage. Cisco’s guidance is to use it where the platform supports it.

Choose the algorithm explicitly rather than trusting a default:

R1(config)# enable algorithm-type scrypt secret C1sco!2026
R1(config)# username netadmin algorithm-type scrypt secret Str0ng!Pass

Entered as enable secret C1sco!2026 with no algorithm-type keyword, many images still produce a type 5 hash, so the keyword is how you guarantee what you get. You can also paste a pre-hashed value by supplying the digit yourself, which is how a configuration copied from one device to another keeps working: enable secret 9 $9$xR7kQm2VbN0pLe$Hs3 stores that hash verbatim rather than hashing the string again.

Because a hash cannot be reversed, a forgotten enable secret cannot be recovered. It can only be replaced, which is what the console password recovery procedure exists to do, and which is covered alongside line security in securing Cisco device access.

Password length enforcement

R1(config)# security passwords min-length 10

This sets a floor, not a ceiling, and the check runs when a password is being set rather than when it is being used. Passwords entered from that point forward must meet the length; every value already sitting in the configuration keeps working exactly as before.

The command therefore does not clean anything up on its own. A hardening exercise has to pair it with a deliberate pass that re-enters each existing weak credential, otherwise the configuration ends up looking compliant while short passwords remain in force. Two behaviours the command explicitly does not have: it never rejects or disables existing accounts on the spot, which would lock administrators out of a live device, and it never pads a short password to reach the minimum, which would silently change a credential the administrator believes is in place.

How the 200-301 exam tests this

• An excerpt shows a mix of type 9, type 7, and clear-text values and asks which two statements about them are true. The discrimination is always between one-way and reversible: the secret is safe in a leaked file, the type 7 values are not.
• An item asks what service password-encryption actually provides. The correct reading is reversible encoding that defeats casual observation, and the most attractive wrong answer claims it produces the same hash as enable secret.
• A command-selection item asks which global command stores the privileged EXEC password as a hash. enable secret is the answer; enable password, service password-encryption, and username ... password are all offered as near misses because each touches passwords without hashing the enable credential.
• A question about security passwords min-length tests whether you know the rule is forward-looking. Existing passwords survive, nothing is padded, and the value is a minimum rather than a maximum.
• An item may ask what happens after no service password-encryption. Already-encoded values remain type 7 rather than reverting to readable text.

Credential storage is one piece of the device-hardening core of the security fundamentals domain, which is where a disproportionate share of that domain’s questions come from. Drilling it with 200-301 practice questions pays back more per hour than almost anywhere else on the blueprint.

Quick reference

• The leading digit identifies the algorithm: 0 clear text, 7 reversible, 5 MD5, 8 PBKDF2, 9 scrypt.
• Type 7 exists to stop shoulder surfing and provides nothing once the configuration file is copied.
• service password-encryption obscures clear-text values; it does not hash them and does not touch existing secrets.
• Removing service password-encryption leaves existing type 7 values encoded until each is reconfigured.
• enable secret with no keyword often still yields type 5; use algorithm-type sha256 or algorithm-type scrypt to get type 8 or 9.
• A type 5, 8, or 9 value cannot be recovered, only replaced.
• security passwords min-length applies to future password entry only and sets a minimum, never a maximum.