In which configuration mode is service password-encryption used?

The service password-encryption command is entered in Global Config mode on Cisco IOS devices.

SecurityGlobal Config

service password-encryption

Prevent passwords from appearing in cleartext in show running-config output, protecting against shoulder-surfing and casual config file exposure.

Definition: service password-encryption is a Cisco IOS global config command. Enables Cisco Type 7 (Vigenère cipher) encryption for all plaintext passwords stored in the running configuration, including line passwords, CHAP passwords, and username passwords not already using stronger hashing.

Overview

The `service password-encryption` command is a global configuration command on Cisco IOS devices that encrypts all plaintext passwords in the running configuration. When enabled, it applies a weak Cisco proprietary encryption (Type 7) to passwords such as those used for line passwords (console, vty, aux), enable passwords, and username secrets. This prevents casual viewing of password data by someone who gains access to the configuration file, though it is not considered cryptographically secure against determined attackers.

The command is typically used as a basic security measure to protect password confidentiality in configuration backups or during troubleshooting sessions where the config might be displayed. It is important to note that the encryption is applied only to passwords that are configured after the command is enabled; existing plaintext passwords remain unchanged until they are re-entered. The command does not affect enable secret passwords, which are already stored using MD5 hashing (Type 5).

In the broader network security workflow, this command is often one of the first steps in hardening a device, alongside setting enable secrets, configuring SSH, and implementing AAA. The command has no parameters and is simply toggled on or off. When enabled, the router will automatically encrypt any new plaintext password entered in the configuration.

The encryption is reversible (Type 7) and can be decrypted with tools available online, so it should not be relied upon for strong security. The command is available in all IOS versions and is a fundamental part of the Cisco security toolkit. It is important to understand that this command does not encrypt the entire configuration; it only encrypts password fields.

The command is often used in conjunction with `no service password-encryption` to disable the feature, but disabling it does not decrypt existing passwords—they remain encrypted. The command is typically used in global configuration mode and requires no special privilege level beyond the ability to enter global config. The impact on the running configuration is immediate: any subsequent password configuration will be stored in encrypted form.

The command is also useful for ensuring that when you copy the running configuration to a text file for documentation, passwords are not exposed in plaintext. However, for production environments, it is recommended to use enable secret (Type 5) or the newer Type 8/9 encryption for stronger security. The command is a quick and easy way to add a layer of obfuscation, but it should not be the only password protection mechanism.

In summary, `service password-encryption` is a basic security command that encrypts plaintext passwords in the configuration to prevent casual viewing, but it is not a substitute for strong hashing algorithms.

Syntax·Global Config

service password-encryption

When to Use This Command

Minimum-security baseline — obscure all plaintext passwords in the config
Prevent passwords from appearing in cleartext in show running-config output
Required for compliance baselines that mandate password obscuring
Lab environment cleanup before sharing or demonstrating a config

Command Examples

Enable encryption and observe effect

Router(config)# service password-encryption
Router(config)# end
Router# show running-config | include password
password 7 0822455D0A16
enable password 7 060506324F41584B56

Understanding the Output

Type 7 passwords appear as 'password 7 <encrypted-string>'. The '7' designates Cisco's proprietary weak Vigenère encryption — tools freely available online can decrypt Type 7 passwords in seconds. This is obscuration, not real security. enable secret uses MD5 (Type 5) or SHA-256 (Type 8/9) and is not affected by service password-encryption.

Configuration Scenarios

Enable Password Encryption on a New Router

A network administrator is deploying a new Cisco router and wants to ensure that all passwords configured during initial setup are encrypted in the running configuration to prevent exposure during maintenance.

Topology

Single router: R1

Steps

1.Step 1: Enter global configuration mode: R1# configure terminal
2.Step 2: Enable password encryption: R1(config)# service password-encryption
3.Step 3: Configure a line password for console: R1(config)# line console 0
4.Step 4: Set the password: R1(config-line)# password cisco123
5.Step 5: Exit line configuration: R1(config-line)# exit
6.Step 6: Configure enable password: R1(config)# enable password cisco123
7.Step 7: Verify encryption: R1(config)# do show running-config | include password

Configuration

!
R1# configure terminal
R1(config)# service password-encryption
R1(config)# line console 0
R1(config-line)# password cisco123
R1(config-line)# exit
R1(config)# enable password cisco123
R1(config)# end

Verify: Use `show running-config | include password` to see that the passwords are displayed as encrypted strings like `password 7 0822455D0A16` instead of plaintext.

Watch out: If `service password-encryption` is enabled after passwords are already configured, those existing passwords remain in plaintext. You must re-enter each password for encryption to apply.

Encrypt Existing Passwords on a Running Router

A router has been in production with plaintext passwords in the configuration. The administrator wants to encrypt all existing passwords without disrupting operations.

Topology

Single router: R1 with existing plaintext passwords

Steps

1.Step 1: Enter global configuration mode: R1# configure terminal
2.Step 2: Enable service password-encryption: R1(config)# service password-encryption
3.Step 3: Re-enter each existing password to trigger encryption. For example, for the console line: R1(config)# line console 0
4.Step 4: Re-enter the same password: R1(config-line)# password cisco123
5.Step 5: Repeat for all lines and enable password: R1(config-line)# exit
6.Step 6: Re-enter enable password: R1(config)# enable password cisco123
7.Step 7: Verify encryption: R1(config)# do show running-config | include password

Configuration

!
R1# configure terminal
R1(config)# service password-encryption
R1(config)# line console 0
R1(config-line)# password cisco123
R1(config-line)# exit
R1(config)# enable password cisco123
R1(config)# end

Verify: Use `show running-config | include password` to confirm that all passwords now show as encrypted (e.g., `password 7 0822455D0A16`).

Watch out: Simply enabling `service password-encryption` does not encrypt existing passwords; you must re-enter each password. Also, the enable secret password (if used) is already hashed and unaffected by this command.

Troubleshooting with This Command

When troubleshooting password encryption issues, the primary command to use is `show running-config | include password`. Healthy output shows all password fields as encrypted strings starting with `7` (Type 7 encryption). For example: `enable password 7 0822455D0A16` or `password 7 121A0C041104`.

If you see plaintext passwords (e.g., `enable password cisco123`), it indicates that `service password-encryption` is either not enabled or was enabled after the passwords were configured. Another common issue is that the `enable secret` password is stored as a Type 5 MD5 hash (e.g., `enable secret 5 $1$abcdef$...`), which is normal and not affected by this command. If you need to verify the encryption status, use `show running-config | section service` to see if `service password-encryption` is present.

If it is missing, the feature is disabled. A step-by-step diagnostic flow: 1) Check if `service password-encryption` is enabled: `show running-config | include service password-encryption`. 2) If not enabled, enter global config and enable it. 3) Re-enter any passwords that are still plaintext. 4) Verify with `show running-config | include password`. Common symptoms: Users can view plaintext passwords in the config, which is a security risk.

This command helps diagnose whether the encryption feature is active. To correlate with other commands, you can use `show running-config` to see the full configuration and identify any unencrypted passwords. Debug commands are not typically needed for this feature.

If you suspect that the encryption is not working, ensure that you are not using `enable secret` (which is separate) and that you are re-entering passwords after enabling the service. Also, note that Type 7 encryption is reversible, so for stronger security, consider using `enable secret` with Type 8 or Type 9 encryption on newer IOS versions.

CCNA Exam Tips

CCNA exam critical distinction: service password-encryption provides Type 7 weak encryption. enable secret provides Type 5 (MD5) or stronger

Always use enable secret instead of enable password — enable secret is automatically encrypted with MD5 regardless of service password-encryption

If both enable password and enable secret exist, IOS uses enable secret and ignores enable password

Common Mistakes

Thinking Type 7 encryption is secure — it is trivially reversible

Relying only on service password-encryption without enable secret

Not realising the command affects passwords configured BEFORE and AFTER — running it encrypts all existing plaintext passwords

service password-encryption vs username privilege

Both commands enhance device security but address different aspects: service password-encryption protects stored passwords from casual viewing, while username privilege creates authenticated user accounts with specific access levels. They are commonly discussed together in access control contexts.

Aspect	service password-encryption	username privilege
Scope	Applies encryption to all plaintext passwords in config	Creates a single local user with privilege level
Configuration mode	Global configuration	Global configuration
Persistence	Encrypts passwords on write; reversible (Type 7)	Stores hashed password; non-reversible
Precedence	Does not create user accounts	Does not encrypt other passwords
Typical use	Protect line, CHAP, and username passwords from show running	Grant privilege 15 for full admin access or lower for role separation

Use service password-encryption when you need to prevent casual disclosure of all plaintext passwords in the configuration file.

Use username privilege when you need to create specific user accounts with assigned privilege levels for authentication and authorization.

Platform Notes

In IOS-XE, the `service password-encryption` command behaves identically to classic IOS. The syntax and output are the same. In NX-OS, the equivalent command is `service password-encryption` as well, but NX-OS uses a different encryption algorithm (Type 7 is similar but not identical).

On ASA firewalls, the command is also `service password-encryption` and works similarly. In IOS-XR, the command is not available; instead, passwords are always stored in encrypted form by default using Type 7 or stronger algorithms. There are no significant differences between IOS versions 12.x, 15.x, and 16.x regarding this command.

However, newer IOS versions (15.0 and later) support Type 8 and Type 9 encryption for enable secret, which are more secure. The `service password-encryption` command only affects Type 7 encryption. On some platforms, the command may also encrypt other sensitive data like SNMP community strings.

Always verify the behavior on your specific platform.

Related Commands

banner motd

Configures a Message of the Day banner that is displayed to all users who connect to the device before authentication. Used for legal warnings about unauthorized access.

Enables syslog logging of failed login attempts, recording the username attempted, source IP address, and timestamp. Used for security monitoring and brute-force detection.

username privilege

Creates a local user account with a specific privilege level (0-15) and a hashed password stored in the configuration. Privilege 15 grants full access equivalent to enable mode.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions