What Is enable secret? Security Definition
On This Page
Quick Definition
The enable secret command is used on Cisco routers and switches to protect the highest level of administrative access, called privileged EXEC mode. Unlike the older enable password, enable secret encrypts the password using a strong algorithm so it cannot be easily read from the configuration file. This is the recommended way to secure enable access on any Cisco device.
Common Commands & Configuration
Must Know for Exams
The enable secret command appears in the CCNA (200-301) exam, specifically in the 'Network Access' and 'IP Connectivity' sections, under the broader topic of device management and security. Cisco considers the proper configuration of privileged EXEC access as a fundamental skill. You will encounter this concept in multiple question formats: multiple-choice, simulation, and drag-and-drop.
Multiple-choice questions often test the difference between 'enable password' and 'enable secret'. For example: 'Which command provides the most secure form of privileged access on a Cisco router?' The correct answer is 'enable secret', with the explanation that it uses MD5 hashing. Another common question: 'An administrator configures both enable password and enable secret on a router. Which password is used to access privileged EXEC mode?' The correct answer is 'enable secret', because it takes precedence.
Simulation questions (also called lab questions) may require you to configure basic security on a router. You will be asked to set an enable secret password of 'Cisco123'. You must enter global configuration mode and type 'enable secret Cisco123'. Failure to do so, or using 'enable password' instead, will lose points. Some simulations also test password recovery procedures, where you must know that the enable secret is stored in the configuration file and that it can be bypassed during boot by interrupting the startup sequence.
Troubleshooting scenarios might show a configuration snippet where 'enable password' is used with Type 7 encryption, and you must identify the security risk. You will be expected to recommend replacing it with 'enable secret'. In more advanced questions, you might see a configuration with AAA enabled, and you need to know that the local enable secret acts as a fallback if the AAA server is unreachable. This is called 'aaa authentication enable default local'. Knowing the interaction between local and remote authentication is a higher-level exam topic.
Finally, password complexity and length are sometimes tested. You may be asked to determine the minimum recommended length for an enable secret password. Cisco's best practice is 8 characters, but exams often expect you to know that it can be up to 25 characters. Also, the special characters that are allowed and forbidden (e.g., the question mark) can appear in exam questions.
Simple Meaning
Imagine you are the manager of a large office building. You have a master key that opens every door in the building. That master key is extremely powerful, so you want to keep it in a safe that only you can open. But if you just write the combination down on a piece of paper and leave it on your desk, anyone can walk by, read it, and take your master key. That is essentially what the old 'enable password' command did. It stored the password in plain text (or with a very weak scrambling) in the device's configuration file. Anyone who could view that configuration file, even accidentally, would know your master password.
Now, instead of writing the combination on paper, you put it in a special lockbox that only you know how to open. Even if someone steals the lockbox, they cannot find out the combination because the lockbox scrambles the numbers using a one-way process. That is what 'enable secret' does. It takes your password and scrambles it using a cryptographic hash function (specifically, MD5 by default, though stronger options are available). This means the password itself is never stored on the device. Instead, a scrambled version is stored. When you type the password to enter privileged EXEC mode, the device scrambles what you typed in the same way and compares the scrambled result to the stored scrambled version. If they match, you get in. But if someone reads the configuration file, all they see is that scrambled gibberish, which cannot be unscrambled to reveal the original password.
In everyday terms, think of baking a cake. You have a recipe (the password). You bake the cake (scramble the password). Now, if I give you the finished cake, you cannot tell me exactly what ingredients were used or their exact amounts. You can bake another cake using the same recipe and compare the two cakes, but you cannot reverse the cake back into flour and eggs. Enable secret works the same way: it creates a 'cake' from your password, and only by baking the same recipe again can you prove you know the original ingredients.
Full Technical Definition
The 'enable secret' command is a Cisco IOS configuration directive used to set a password that grants access to privileged EXEC mode (also called enable mode), which is the highest operational privilege level (level 15) on a Cisco device. It was introduced to address the critical security weakness of the original 'enable password' command, which stored the password in plain text or used a very weak Type 7 encryption (Vigenère cipher) that could be easily reversed with free online tools.
When an administrator configures 'enable secret <password>', the Cisco IOS immediately processes the plaintext password through a one-way cryptographic hash function. By default, this hash is MD5 (Message Digest 5) with a 128-bit output. However, modern Cisco IOS versions also support SHA-256 and SHA-512 hashing algorithms for stronger security. The hashing process includes a 'salt' — a random string of characters added to the password before hashing. This prevents two identical passwords from producing the same hash (a rainbow table attack). The resulting salted hash is then stored in the running configuration as a string starting with '$1$' for MD5, '$5$' for SHA-256, or '$6$' for SHA-512. The configuration line looks like: 'enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKXp70' (the '5' indicates Type 5 encryption, commonly used for MD5).
When a user attempts to enter privileged EXEC mode (by typing 'enable' at the user EXEC prompt), the system prompts for a password. The user's typed input is combined with the stored salt, hashed using the same algorithm, and compared to the stored hash. If they match, access is granted. If not, the user remains in user EXEC mode.
It is important to note that 'enable secret' operates independently from 'enable password'. If both are configured, 'enable secret' takes precedence, and 'enable password' is only used if no 'enable secret' is configured. This is a common exam point. Additionally, the 'enable secret' password is case-sensitive and can be up to 25 characters in length. It cannot contain the question mark character (?) because that is reserved for context-sensitive help in Cisco IOS.
From a protocol perspective, the hashing is done locally on the device. There is no network transmission of the password in plaintext. The hash is stored in NVRAM as part of the startup configuration, so it persists across reboots. For centralized management, AAA (Authentication, Authorization, and Accounting) servers like TACACS+ or RADIUS can be used instead of local enable secret, but the local secret remains a critical fallback.
Real-Life Example
Think of the enable secret as the high-security combination lock on a bank vault's inner door. The older 'enable password' was like a simple keypad lock with the code written on a sticky note stuck right next to the keypad. Anyone who walked by could see the code and open the vault. The bank manager decides to upgrade to a modern, secure combination lock. This new lock does not store the actual combination. Instead, it stores a scrambled version of the combination — like a fingerprint of the code. When you enter a combination, the lock scrambles what you typed in the exact same way and checks if it matches the stored scrambled code. Even if a thief breaks open the lock and reads the internal memory, they only find the scrambled code. They cannot derive the original combination from it.
Now, apply this to a Cisco router in a corporate network. The network administrator needs to configure the router to prevent unauthorized changes. They connect to the router via console or SSH and enter global configuration mode. They type 'enable secret MySecurePass123'. The router's operating system immediately takes that password, adds a random salt (a few extra characters), runs it through a cryptographic hash function, and stores only the resulting hash. Later, a junior admin accidentally leaves a terminal session open, and a malicious employee walks by and types 'show running-config'. They see the line 'enable secret 5 $1$abcdefg$hijklmnopqrstuvwxyz'. That gibberish is the hash. The attacker knows it is a hash, but has no way to turn it back into 'MySecurePass123'. They cannot log in to privileged mode. This simple action protects the entire network infrastructure from being reconfigured or shut down by an unauthorized person.
Why This Term Matters
In practical IT, the enable secret is a foundational security control. It is literally the password that protects the highest level of administrative access on virtually every Cisco router and switch in the world. If an attacker obtains this password, they can change the device's configuration, disable interfaces, delete logging, add backdoors, or even erase the entire configuration and operating system. For this reason, the enable secret is often the first password changed when a new device is deployed and is regularly rotated as part of security policies.
Beyond just setting a password, the method of storage matters enormously. Regulatory compliance frameworks like PCI DSS, HIPAA, and SOX require that passwords be stored using strong, one-way encryption. Using 'enable password' (Type 7) would be a violation because it is reversible. Auditors check for the presence of 'enable secret' in configurations. Many organizations also enforce that the enable secret be at least 15 characters and not be a dictionary word. Network automation scripts that push configurations must be carefully designed not to expose the enable secret in logs or version control systems.
From an operational standpoint, losing the enable secret is a major incident. It often requires a physical visit to the device's location to perform a password recovery procedure, which involves interrupting the boot process and resetting the password. For remote sites, this can mean significant downtime and travel costs. Therefore, enable secrets are often stored in secure password managers with strict access controls, and multiple administrators may have different enable secrets (using multiple privilege levels or AAA) to avoid a single point of failure. In summary, the enable secret is not just a command — it is a critical component of network defense-in-depth.
How It Appears in Exam Questions
Exam questions use the enable secret in three main patterns: configuration, security analysis, and troubleshooting.
Configuration Pattern: A typical question gives you a scenario: 'An engineer is configuring a new Cisco 4321 router. The security policy requires that the privileged EXEC password be stored using a strong, one-way hash. Which command should the engineer use?' The answer choices include 'enable password', 'enable secret', 'enable algorithm-type sha256 secret', and 'enable password 7'. The correct answer is 'enable secret' or, in more modern exams, 'enable algorithm-type sha256 secret' if the question specifically mentions SHA-256. The question might also ask for the exact syntax: 'Which of the following correctly sets the enable secret to 'Admin$Pass'?' You must choose the command with the correct spelling and spacing.
Security Analysis Pattern: The question shows a partial output from 'show running-config': 'enable secret 5 $1$abcdefg$hijklmnopqrstuvwxyz'. You are asked: 'What type of encryption is used for this password?' The answer is 'MD5' (Type 5). Another variant shows 'enable password 7 08314F5D5A5A'. You must identify that this is the old, weak Type 7 encryption and recommend using 'enable secret' instead. Sometimes the question asks: 'A security audit reveals that the enable password is stored as 'enable password cisco'. What is the security implication?' You must explain that the password is in plain text in the configuration, which is a significant vulnerability.
Troubleshooting Pattern: A technician tries to access privileged EXEC mode on a router but cannot remember the password. They perform a password recovery by interrupting the boot process and entering configuration mode. The question asks: 'After resetting the password and reloading the device, which command must be configured to restore secure privileged access?' The answer is 'enable secret', not 'enable password'. Another troubleshooting question might describe a situation where the enable secret is configured, but the user is still prompted for a password and cannot log in even after entering the correct password. The issue could be a typo in the configuration, or the password might have been changed inadvertently. The solution is to verify the configuration using 'show running-config | include enable secret'.
Practise enable secret Questions
Test your understanding with exam-style practice questions.
Example Scenario
You are the network administrator for a small company with 50 employees. You have just received a new Cisco 2960 switch that will connect all the office computers. Your first task is to secure the switch so that only you can make configuration changes. The switch is brand new and has no password configured yet. You connect a console cable from your laptop to the switch, and you access the command-line interface (CLI).
First, you are in user EXEC mode, indicated by the '>' symbol. You type 'enable' to go to privileged EXEC mode, and since no password is set, you are immediately moved to the '#' prompt. Now you could accidentally change critical settings. To prevent this, you must set a password for the 'enable' command. You know that simply setting a password is not enough; it must be stored securely. So you type 'configure terminal' to enter global configuration mode. Then you type 'enable secret MyCompany2024'. The switch accepts the command. You verify by typing 'do show running-config | include enable secret'. You see a long scrambled string. You then exit back to privileged EXEC mode by typing 'end', and then 'exit' to go back to user EXEC mode. Now you type 'enable' again. The switch prompts you for a password. You type 'MyCompany2024' and you are granted access.
Later, a co-worker happens to see the switch's configuration file (perhaps through a monitoring tool that captures configurations). They see the line 'enable secret 5 $1$abcdefg$hijklmnopqrstuvwxyz'. They have no idea what the password is. Even if they try to crack the hash, it will take a very long time if the password is strong. Your switch remains secure. If you had used 'enable password MyCompany2024', the configuration would show 'enable password MyCompany2024' in plain text, and your co-worker would immediately know the password and could make unauthorized changes. This scenario shows exactly why enable secret is a mandatory security step in real network deployments.
Common Mistakes
Using 'enable password' instead of 'enable secret' because it is easier to remember or type.
'enable password' stores the password using either no encryption (plain text) or the weak Type 7 encryption that can be easily reversed. This exposes the password to anyone who can view the configuration file, which is a major security vulnerability.
Always use 'enable secret <password>' for any Cisco device. If you need backward compatibility with older devices that do not support 'enable secret', still prefer it and use 'enable password' only as a last resort, and never in a production environment.
Configuring both 'enable password' and 'enable secret' with different passwords and assuming the device will prompt for both.
When both are configured, only 'enable secret' is used for authentication. The 'enable password' is completely ignored. This can cause confusion if you attempt to log in using the 'enable password' and wonder why it does not work. It also creates a false sense of security because the weak password still exists in the configuration, even though it is not used.
Configure only 'enable secret'. If you must have both (e.g., for migration), ensure they are set to the same password and clearly note in documentation that 'enable secret' takes precedence. The best practice is to remove the 'enable password' entirely using 'no enable password'.
Using a weak or easily guessable password for enable secret, such as 'cisco', 'password', or the router's hostname.
Although the password is hashed, a weak password can be cracked using dictionary or brute-force attacks on the hash. If an attacker obtains the configuration file (which is often the case in security breaches), they can attempt to crack the hash offline. Weak passwords are the first to be compromised.
Use a strong password of at least 12-15 characters, mixing uppercase, lowercase, numbers, and special characters. Avoid common words, dates, or patterns. Consider using a password manager to generate and store the password securely.
Typing the enable secret command with a question mark (?) in the password.
The question mark character has special meaning in Cisco IOS — it triggers context-sensitive help. If you include a '?' in the password string, the IOS interprets it as a request for help and will not accept the password. This can lead to confusion and failed configuration attempts.
Avoid using the question mark character in any Cisco IOS password. If you need a special character, use others like !, @, #, $, %, or *.
Exam Trap — Don't Get Fooled
{"trap":"The exam shows 'enable password cisco' in the configuration and asks if it is secure. The learner thinks it is okay because it is 'password' and not 'secret'.","why_learners_choose_it":"Learners often see the word 'password' and assume it is encrypted.
They may not know the difference between 'enable password' (weak Type 7 or plain text) and 'enable secret' (strong hash). They also might think that if the configuration does not show the plain text, some form of encryption is applied, but Type 7 is trivially reversible.","how_to_avoid_it":"Memorize the key fact: 'enable secret' uses a one-way hash (Type 5 or higher), while 'enable password' uses reversible Type 7 or no encryption.
In exam scenarios, if you see 'enable password' without a '5' after it, it is insecure. Always look for the 'secret' keyword. Also, know the command 'show running-config | include enable' will show both lines if configured, and the one with 'secret' is the one actually used."
Commonly Confused With
Enable password is the older, less secure command that stores the password using reversible Type 7 encryption or, if no type is specified, in plain text. Enable secret uses a one-way cryptographic hash (MD5 by default) that cannot be reversed. If both are configured, enable secret takes precedence.
On a router, if you set 'enable password cisco' and 'enable secret MySecurePass', a user logging in must provide 'MySecurePass', not 'cisco'. The configuration will show 'enable password cisco' as text, exposing it.
This is a more modern variant of enable secret that uses the SHA-256 hashing algorithm instead of the default MD5. It provides stronger cryptographic security and is recommended for newer devices. The command syntax is 'enable algorithm-type sha256 secret <password>'. The default 'enable secret' uses MD5.
On a Cisco IOS 15.0 or later, you can type 'enable algorithm-type sha256 secret MyPassword' to store the hash using SHA-256, which is more resistant to brute-force attacks than MD5.
Service password-encryption is a global configuration command that encrypts all plaintext passwords displayed in the configuration file, including 'enable password', but it uses the weak Type 7 encryption. It does not affect 'enable secret', which is already hashed. It is a false sense of security for 'enable password' because Type 7 is easily reversible.
If you configure 'service password-encryption', a line like 'enable password cisco' becomes 'enable password 7 0822455D0A16', but that can be decoded back to 'cisco' using online tools.
Step-by-Step Breakdown
Access the Cisco device CLI
Connect to the Cisco router or switch using a console cable, SSH, or Telnet. Once connected, you are in user EXEC mode, indicated by a '>' prompt. For example: 'Router>'. This mode has very limited viewing and no configuration capabilities.
Enter privileged EXEC mode
Type 'enable' at the prompt. If no enable secret or enable password is configured, you will immediately enter privileged EXEC mode, indicated by a '#' prompt (e.g., 'Router#'). This mode allows you to view the running configuration and enter global configuration mode. If a password is already set, you will be prompted for it.
Enter global configuration mode
From privileged EXEC mode, type 'configure terminal' (or 'conf t'). The prompt changes to 'Router(config)#'. This is the mode where you can make changes to the device's global settings, including setting the enable secret.
Configure the enable secret
Type 'enable secret <your-password>', replacing '<your-password>' with the desired password (e.g., 'enable secret MySecurePass123'). Press Enter. The Cisco IOS immediately hashes the password using MD5 (or the configured algorithm) and stores the hash. The prompt remains in global configuration mode. There is no confirmation message if successful.
Verify the configuration
Exit global configuration mode by typing 'end' or pressing Ctrl+Z. Then, from privileged EXEC mode, type 'show running-config | include enable secret'. You should see a line similar to 'enable secret 5 $1$abcdefg$hijklmnopqrstuvwxyz'. The '$1$' indicates MD5 hashing. Verify that the password you set is now represented as a hash.
Test the enable secret
Type 'exit' to return to user EXEC mode ('Router>'). Then type 'enable'. The device will prompt 'Password:'. Enter the password you set. If successful, you will be granted access to privileged EXEC mode. If you enter a wrong password, you will receive '% Bad secrets' and remain in user EXEC mode. This confirms the secret is working.
Save the configuration
From privileged EXEC mode, type 'copy running-config startup-config' or 'write memory'. This saves the hashed enable secret to NVRAM so that it persists after a reboot. Without this step, the secret will be lost on the next reload.
Practical Mini-Lesson
When you configure a Cisco device for the first time, setting the enable secret should be one of your first actions. Think of it as locking the front door of your network. Without it, anyone who can reach the command line — even through a serial console or a temporary management IP — can take full control of the device. In real-world environments, network administrators often use automation tools like Ansible, Puppet, or Python scripts to push configurations to hundreds of devices. These scripts must handle enable secrets carefully. For example, an Ansible playbook might use the 'ios_config' module to set the enable secret, but the plaintext password must be stored in an encrypted Ansible vault or a secure secrets management system, not in plain text in the playbook file.
Another practical consideration is password rotation. Many security policies require changing the enable secret every 90 days. If you manage 100 routers, manually changing each one is impractical. Instead, you can use a script that connects to each device via SSH, sends the 'enable secret' command with the new password, and saves the configuration. However, you must be careful: if the script fails partway through, some devices may have the new password and some the old, causing confusion. A best practice is to change the enable secret during a maintenance window and verify access immediately.
What can go wrong? The most common problem is forgetting the enable secret. If you lose it, you cannot perform any configuration changes. You must perform a password recovery, which involves physically accessing the device, interrupting the boot process, and resetting the password. For remote devices, this means a site visit. To avoid this, always store the enable secret in a secure password manager with multiple administrators having access. Also, consider configuring a secondary method of authentication, such as AAA with TACACS+ or RADIUS, which provides a centralized authentication system. On many networks, the enable secret is used only as a local fallback if the AAA server is unreachable. In that case, the enable secret is set to a very long, complex password that is stored in a sealed envelope and locked in a safe.
Finally, be aware of the different hash algorithms. On older devices, only MD5 is available. On modern Cisco IOS versions (15.0 and later), you can specify 'enable algorithm-type sha256 secret' or 'enable algorithm-type scrypt secret' for stronger hashing. Some security auditors require SHA-256 or higher. The command 'show security passwords' (on some platforms) can help verify the strength of configured passwords. Always use the strongest algorithm supported by your hardware.
Troubleshooting Clues
Symptom:
Symptom:
Symptom:
Symptom:
Memory Tip
Remember: 'Secret' means 'secure hash'. 'Password' means 'plain text or weak encryption'. If you SEE the word 'secret' in the config, you have strong security. If you SEE the word 'password', it is weak.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
200-301Cisco CCNA →N10-009CompTIA Network+ →220-1202CompTIA A+ Core 2 →SC-900SC-900 →CDLGoogle CDL →ISC2 CCISC2 CC →Related Glossary Terms
Two-factor authentication (2FA) is a security method that requires two different types of proof before granting access to an account or system.
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
An A record is a DNS record that maps a domain name to the IPv4 address of the server hosting that domain.
Quick Knowledge Check
Frequently Asked Questions
Can I recover the original password from an enable secret hash?
No, the hash is one-way. It is cryptographically impossible to reverse the hash to the original password. If you forget the password, you must perform a password recovery procedure on the device.
What is the difference between 'enable secret' and 'service password-encryption'?
'Enable secret' hashes the enable password using a strong one-way algorithm. 'Service password-encryption' encrypts all plaintext passwords in the config using a weak Type 7 encryption. They serve different purposes; enable secret is much more secure.
How long can the enable secret password be?
The maximum length is 25 characters. The password is case-sensitive and cannot contain the question mark character (?).
Can I use special characters in my enable secret?
Yes, you can use most special characters like !, @, #, $, %, ^, &, *, etc. However, you cannot use the question mark (?) because it triggers context-sensitive help in Cisco IOS.
What happens if I configure both 'enable password' and 'enable secret' with different passwords?
Only the enable secret password is accepted. The enable password is ignored and is not used for authentication. It can be removed safely with the 'no enable password' command.
Does enable secret use MD5 by default? Is that secure enough?
Yes, MD5 is the default. While MD5 is considered weak for some applications due to collision vulnerabilities, it is still reasonably secure for password storage in Cisco IOS when combined with a salt. For higher security, use 'enable algorithm-type sha256 secret' on modern IOS versions.
Summary
The 'enable secret' command is a cornerstone of Cisco device security, providing a one-way cryptographic hash (MD5 by default) for the password that grants privileged EXEC access. It directly replaces the outdated 'enable password' command, which stored passwords in plain text or with weak Type 7 encryption. In the CCNA exam, you will be tested on the difference between these two commands, the precedence rule (enable secret overrides enable password), and the importance of using strong, hashed passwords. In real-world IT, enable secret is a mandatory configuration for any network administrator responsible for Cisco routers and switches. It protects against unauthorized configuration changes, which could lead to network outages, data breaches, or compliance violations.
To master this concept, remember the key points: always use 'enable secret' instead of 'enable password'; never use the question mark in the password; save the configuration after setting the secret; and store the password in a secure location. For modern deployments, consider using 'enable algorithm-type sha256 secret' for stronger security. When troubleshooting, first verify with 'show running-config | include enable secret' that the secret is configured. If you are locked out, understand the password recovery procedure. Finally, the memory tip to carry into the exam is: if you see the word 'secret', think secure hash. If you see 'password', think weak or plain text. This simple rule will help you answer security-related questions correctly on exam day.