Decrypt Type 7 Password using Key-Chain

Hello Leonard

Short answer: No, the key-chain method only works for Type 7 passwords and cannot be used on Type 5 (or Type 8/9) passwords. The key reason comes down to the fundamental difference between encryption and hashing:

Type 7 is reversible encryption. It uses Cisco’s Vigenère-style XOR obfuscation with a publicly known key. Because it’s designed to be reversible, the router can recover the original plaintext, and that’s exactly what the key-chain trick exploits. When you paste a Type 7 string into key-string 7, the router recognizes it and displays the plaintext. This works because the algorithm is intentionally two-way.

Type 5 is a one-way MD5 hash. This is fundamentally different. Hashing is designed to be irreversible,. There is no algorithm to go from Type 5 hash → plaintext. The same applies to Type 8 (PBKDF2-SHA256) and Type 9 (scrypt), which are even stronger one-way hashes with salting and iteration.

If you look at what the key-chain key-string command actually accepts, you’ll see:

R1(config-keychain-key)#key-string ?
  0     Specifies an UNENCRYPTED password will follow
  7     Specifies a HIDDEN password will follow
  LINE  The UNENCRYPTED (cleartext) user password

There is no 5 option. The router has no mechanism to accept or process a Type 5 hash in that field, because the underlying trick only works with reversible encryption.

I hope this has been helpful!

Laz