<p>@kenorb example with <code>hudson.util.Secret</code> is good. Also answers listing all credentials are very useful (thanks @ymajoros for one-liner).</p>
<p>These do not handle secret files though where <code>secretBytes</code> are used and still an encrypted string is shown. In such case the <code>SecretBytes</code> class needs to be used. Assuming the file is UTF-8, one can do:</p>
<pre class="lang-java prettyprint-override"><code>secret = &quot;{....}&quot;
new String(com.cloudbees.plugins.credentials.SecretBytes.fromString(secret).getPlainData())
</code></pre>
<p>HTH</p>
<p><strong>Update:</strong> This is the full solution from <a href="https://gist.github.com/akostadinov/d4d695d11b0215c7acc8af5fe82a25bd" rel="nofollow noreferrer">my gits</a>:</p>
<pre class="lang-java prettyprint-override"><code>com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
  it.properties.each { prop, val -&gt;
    if (prop == &quot;secretBytes&quot;) {
      println(prop + &quot;=&gt;\n&quot; + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString(&quot;${val}&quot;).getPlainData()) + &quot;\n&quot;)
    } else {
      println(prop + ' = &quot;' + val + '&quot;')
    }
  }
  println(&quot;-----------------------&quot;)
}
</code></pre>

CC BY-SA 4.0
2020-02-19T11:08:30.603Z
2021-10-11T15:01:11.063Z
2021-10-11T15:01:11.063Z
akostadinov
<p>For the record, The following snippet to be pasted into the console also does the job :</p>

<pre class="lang-java prettyprint-override"><code>def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
    com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class,
    Jenkins.instance,
    null,
    null
)

for(c in creds) {
  if(c instanceof com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey){
    println(String.format("id=%s  desc=%s key=%s\n", c.id, c.description, c.privateKeySource.getPrivateKeys()))
  }
  if (c instanceof com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl){
    println(String.format("id=%s  desc=%s user=%s pass=%s\n", c.id, c.description, c.username, c.password))
  }
}
</code></pre>

CC BY-SA 4.0
2019-08-16T09:04:52.857Z
2019-08-16T09:04:52.857Z
jmary
<p>Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text.</p>

<pre class="lang-java prettyprint-override"><code>com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
  it.properties.each { prop, val -&gt;
    if (prop == "secretBytes") {
      println(prop + "=&gt;\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n")
    } else {
      println(prop + ' = "' + val + '"')
    }
  }
  println("-----------------------")
}
</code></pre>

<p>A more complicated version that lists for non-system credential providers:</p>

<pre class="lang-java prettyprint-override"><code>import com.cloudbees.plugins.credentials.CredentialsProvider
import com.cloudbees.plugins.credentials.Credentials
import com.cloudbees.plugins.credentials.domains.Domain
import jenkins.model.Jenkins
def indent = { String text, int indentationCount -&gt;
  def replacement = "\t" * indentationCount
  text.replaceAll("(?m)^", replacement)
}

Jenkins.get().allItems().collectMany{ CredentialsProvider.lookupStores(it).toList()}.unique().forEach { store -&gt;
  Map&lt;Domain, List&lt;Credentials&gt;&gt; domainCreds = [:]
  store.domains.each { domainCreds.put(it, store.getCredentials(it))}
  if (domainCreds.collectMany{ it.value}.empty) {
    return
  }
  def shortenedClassName = store.getClass().name.substring(store.getClass().name.lastIndexOf(".") + 1)
  println "Credentials for store context: ${store.contextDisplayName}, of type $shortenedClassName"
  domainCreds.forEach { domain , creds -&gt;
    println indent("Domain: ${domain.name}", 1)
    creds.each { cred -&gt;
      cred.properties.each { prop, val -&gt;
        println indent("$prop = \"$val\"", 2)
      }
      println indent("-----------------------", 2)
    }
  }
}
</code></pre>

CC BY-SA 4.0
2019-08-14T09:47:20.453Z
How to modify this to get credentials from all domains, from all folders ?
jmary
CC BY-SA 4.0
2019-08-15T00:58:17.880Z
@jmary I have added another example
Magnus
CC BY-SA 4.0
2019-08-16T09:00:01.393Z
Great thanks :-)
jmary
CC BY-SA 4.0
2020-01-17T10:36:20.080Z
if you want an even simpler oneliner: `com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}`
ymajoros
CC BY-SA 4.0
2021-10-10T13:20:56.010Z
In a very old Jenkins implementation replace Jenkins.get() with Jenkins.getActiveInstance()
guymi
CC BY-SA 4.0
2023-05-24T07:46:48.377Z
I keep coming back to this again and again, thanks mate!
Junaid
CC BY-SA 4.0
2019-07-23T23:36:17.910Z
2020-04-14T00:58:30.317Z
2020-04-14T00:58:30.317Z
Magnus
<p>Based on Magnus' answer but as a simple one-liner with still readable output:</p>
<pre><code>com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}
</code></pre>

CC BY-SA 4.0
2020-02-19T11:03:13.177Z
Short and nice!
akostadinov
CC BY-SA 4.0
2020-01-17T10:38:42.463Z
2022-07-13T08:37:20.113Z
2022-07-13T08:37:20.113Z
ymajoros
<p>Luckily there is a <code>hudson.util.Secret.decrypt()</code> function which can be used for this, so:</p>

<ol>
<li>In Jenkins, go to: <code>/script</code> page.</li>
<li><p>Run the following command:</p>

<pre><code>println(hudson.util.Secret.decrypt("{XXX=}"))
</code></pre>

<p>or:</p>

<pre><code>println(hudson.util.Secret.fromString("{XXX=}").getPlainText())
</code></pre>

<p>where <code>{XXX=}</code> is your encrypted password. This will print the plain password.</p>

<p>To do opposite, run:</p>

<pre><code>println(hudson.util.Secret.fromString("some_text").getEncryptedValue())
</code></pre></li>
</ol>

<p><sup>Source: <a href="https://gist.github.com/tuxfight3r/eca9442ff76649b057ab" rel="noreferrer">gist at <code>tuxfight3r/jenkins-decrypt.groovy</code></a>.</sup></p>

<hr>

<p>Alternatively check the following scripts: <a href="https://github.com/tweksteen/jenkins-decrypt" rel="noreferrer"><code>tweksteen/jenkins-decrypt</code></a>,
 <a href="https://gist.github.com/menski/8f9980999ed43246b9b2" rel="noreferrer"><code>menski/jenkins-decrypt.py</code></a>.</p>

<hr>

<p>For more details, check: <a href="http://xn--thibaud-dya.fr/jenkins_credentials.html" rel="noreferrer">Credentials storage in Jenkins</a>.</p>

CC BY-SA 4.0
2020-02-19T11:13:37.407Z
+1, for secret files that use `SecretBytes` class, you can see my answer.
akostadinov
CC BY-SA 3.0
2017-09-28T16:42:49.333Z
2017-09-28T22:15:34.657Z
2017-09-28T22:15:34.657Z
kenorb
<p>I've taken over the project where a lot of Jenkins credentials has passwords or passphrase strings which I need to know in order to progress with the project, unfortunately these weren't documented anywhere.</p>

<p>I've checked the <code>credentials.xml</code> file where these credentials are stored, but they're in not plain text, e.g.:</p>

<pre><code>&lt;passphrase&gt;{AAAAAAAAAAAANzxft/rDzyt8mhxpn3O72dxvVqZksL5vBJ4jNKvAjAA=}&lt;/passphrase&gt;
</code></pre>

<p><sup>Note: I've changed it slightly for privacy reasons.</sup></p>

<p>How can I decrypt its original password based on the string above?</p>

CC BY-SA 4.0
2019-06-14T17:35:55.460Z
I am getting error with the proposed answer:
println(hudson.util.Secret.decrypt("{{xxx/wwww+yyyy/zzzz=}}"))
The + symbol is breaking the script. Any suggestion?
Jay Bau
CC BY-SA 4.0
2019-06-17T11:37:28.330Z
@JayBau Try with single brackets: `"{...}"`, remove extra once.
kenorb
CC BY-SA 4.0
2020-03-05T09:46:40.913Z
This is practically a duplicate of an SO question: https://stackoverflow.com/questions/37683143/ (although technically it would only qualify as a duplicate if the linked question was asked on DevOps).
Attila Csipak
<jenkins><encryption>
How to decrypt Jenkins passwords from credentials.xml?
kenorb
# How to decrypt Jenkins passwords from credentials.xml?

(Asked by: username_0 on 2017-09-28)

I've taken over the project where a lot of Jenkins credentials has passwords or passphrase strings which I need to know in order to progress with the project, unfortunately these weren't documented anywhere.
I've checked the credentials.xml file where these credentials are stored, but they're in not plain text, e.g.:
{AAAAAAAAAAAANzxft/rDzyt8mhxpn3O72dxvVqZksL5vBJ4jNKvAjAA=}

Note: I've changed it slightly for privacy reasons.
How can I decrypt its original password based on the string above?

**Tags:** jenkins, encryption

> **Comments:**
> **username_1**: I am getting error with the proposed answer: println(hudson.util.Secret.decrypt("{{xxx/wwww+yyyy/zzzz=}}")) The + symbol is breaking the script. Any suggestion?  
> **username_0**: @JayBau Try with single brackets: `"{...}"`, remove extra once.  
> **username_2**: This is practically a duplicate of an SO question: https://stackoverflow.com/questions/37683143/ (although technically it would only qualify as a duplicate if the linked question was asked on DevOps).  

---

## 5 answers

### Answer by username_0 on 2017-09-28. Score: 128 | Accepted answer

Luckily there is a hudson.util.Secret.decrypt() function which can be used for this, so:

In Jenkins, go to: /script page.
Run the following command:
println(hudson.util.Secret.decrypt("{XXX=}"))

or:
println(hudson.util.Secret.fromString("{XXX=}").getPlainText())

where {XXX=} is your encrypted password. This will print the plain password.
To do opposite, run:
println(hudson.util.Secret.fromString("some_text").getEncryptedValue())


Source: gist at tuxfight3r/jenkins-decrypt.groovy.

Alternatively check the following scripts: tweksteen/jenkins-decrypt,
 menski/jenkins-decrypt.py.

For more details, check: Credentials storage in Jenkins.

> **Comments:**
> **username_3**: +1, for secret files that use `SecretBytes` class, you can see my answer.  

---

### Answer by username_5 on 2019-07-23. Score: 38

Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text.
com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
  it.properties.each { prop, val ->
    if (prop == "secretBytes") {
      println(prop + "=>\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n")
    } else {
      println(prop + ' = "' + val + '"')
    }
  }
  println("-----------------------")
}

A more complicated version that lists for non-system credential providers:
import com.cloudbees.plugins.credentials.CredentialsProvider
import com.cloudbees.plugins.credentials.Credentials
import com.cloudbees.plugins.credentials.domains.Domain
import jenkins.model.Jenkins
def indent = { String text, int indentationCount ->
  def replacement = "\t" * indentationCount
  text.replaceAll("(?m)^", replacement)
}

Jenkins.get().allItems().collectMany{ CredentialsProvider.lookupStores(it).toList()}.unique().forEach { store ->
  Map> domainCreds = [:]
  store.domains.each { domainCreds.put(it, store.getCredentials(it))}
  if (domainCreds.collectMany{ it.value}.empty) {
    return
  }
  def shortenedClassName = store.getClass().name.substring(store.getClass().name.lastIndexOf(".") + 1)
  println "Credentials for store context: ${store.contextDisplayName}, of type $shortenedClassName"
  domainCreds.forEach { domain , creds ->
    println indent("Domain: ${domain.name}", 1)
    creds.each { cred ->
      cred.properties.each { prop, val ->
        println indent("$prop = \"$val\"", 2)
      }
      println indent("-----------------------", 2)
    }
  }
}

> **Comments:**
> **username_4**: How to modify this to get credentials from all domains, from all folders ?  
> **username_5**: @username_4 I have added another example  
> **username_4**: Great thanks :-)  
> **username_6**: if you want an even simpler oneliner: `com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}`  
> **username_7**: In a very old Jenkins implementation replace Jenkins.get() with Jenkins.getActiveInstance()  
> **username_8**: I keep coming back to this again and again, thanks mate!  

---

### Answer by username_6 on 2020-01-17. Score: 10

Based on username_5' answer but as a simple one-liner with still readable output:
com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}

> **Comments:**
> **username_3**: Short and nice!  

---

### Answer by username_3 on 2020-02-19. Score: 5

@username_0 example with hudson.util.Secret is good. Also answers listing all credentials are very useful (thanks @username_6 for one-liner).
These do not handle secret files though where secretBytes are used and still an encrypted string is shown. In such case the SecretBytes class needs to be used. Assuming the file is UTF-8, one can do:
secret = "{....}"
new String(com.cloudbees.plugins.credentials.SecretBytes.fromString(secret).getPlainData())

HTH
Update: This is the full solution from my gits:
com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
  it.properties.each { prop, val ->
    if (prop == "secretBytes") {
      println(prop + "=>\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n")
    } else {
      println(prop + ' = "' + val + '"')
    }
  }
  println("-----------------------")
}


---

### Answer by username_4 on 2019-08-16. Score: 4

For the record, The following snippet to be pasted into the console also does the job :
def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
    com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class,
    Jenkins.instance,
    null,
    null
)

for(c in creds) {
  if(c instanceof com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey){
    println(String.format("id=%s  desc=%s key=%s\n", c.id, c.description, c.privateKeySource.getPrivateKeys()))
  }
  if (c instanceof com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl){
    println(String.format("id=%s  desc=%s user=%s pass=%s\n", c.id, c.description, c.username, c.password))
  }
}


---

