Answers: <p>@kenorb example with <code>hudson.util.Secret</code> is good. Also answers listing all credentials are very useful (thanks @ymajoros for one-liner).</p>
  <p>These do not handle secret files though where <code>secretBytes</code> are used and still an encrypted string is shown. In such case the <code>SecretBytes</code> class needs to be used. Assuming the file is UTF-8, one can do:</p>
  <pre class="lang-java prettyprint-override"><code>secret = &quot;{....}&quot;
  new String(com.cloudbees.plugins.credentials.SecretBytes.fromString(secret).getPlainData())
  </code></pre>
  <p>HTH</p>
  <p><strong>Update:</strong> This is the full solution from <a href="https://gist.github.com/akostadinov/d4d695d11b0215c7acc8af5fe82a25bd" rel="nofollow noreferrer">my gits</a>:</p>
  <pre class="lang-java prettyprint-override"><code>com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
    it.properties.each { prop, val -&gt;
      if (prop == &quot;secretBytes&quot;) {
        println(prop + &quot;=&gt;\n&quot; + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString(&quot;${val}&quot;).getPlainData()) + &quot;\n&quot;)
      } else {
        println(prop + ' = &quot;' + val + '&quot;')
      }
    }
    println(&quot;-----------------------&quot;)
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-19T11:08:30.603Z
Answers: 2021-10-11T15:01:11.063Z
Answers: 2021-10-11T15:01:11.063Z
Answers: akostadinov
Answers: <p>For the record, The following snippet to be pasted into the console also does the job :</p>
  
  <pre class="lang-java prettyprint-override"><code>def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
      com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class,
      Jenkins.instance,
      null,
      null
  )
  
  for(c in creds) {
    if(c instanceof com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey){
      println(String.format("id=%s  desc=%s key=%s\n", c.id, c.description, c.privateKeySource.getPrivateKeys()))
    }
    if (c instanceof com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl){
      println(String.format("id=%s  desc=%s user=%s pass=%s\n", c.id, c.description, c.username, c.password))
    }
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-16T09:04:52.857Z
Answers: 2019-08-16T09:04:52.857Z
Answers: jmary
Answers: <p>Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text.</p>
  
  <pre class="lang-java prettyprint-override"><code>com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
    it.properties.each { prop, val -&gt;
      if (prop == "secretBytes") {
        println(prop + "=&gt;\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n")
      } else {
        println(prop + ' = "' + val + '"')
      }
    }
    println("-----------------------")
  }
  </code></pre>
  
  <p>A more complicated version that lists for non-system credential providers:</p>
  
  <pre class="lang-java prettyprint-override"><code>import com.cloudbees.plugins.credentials.CredentialsProvider
  import com.cloudbees.plugins.credentials.Credentials
  import com.cloudbees.plugins.credentials.domains.Domain
  import jenkins.model.Jenkins
  def indent = { String text, int indentationCount -&gt;
    def replacement = "\t" * indentationCount
    text.replaceAll("(?m)^", replacement)
  }
  
  Jenkins.get().allItems().collectMany{ CredentialsProvider.lookupStores(it).toList()}.unique().forEach { store -&gt;
    Map&lt;Domain, List&lt;Credentials&gt;&gt; domainCreds = [:]
    store.domains.each { domainCreds.put(it, store.getCredentials(it))}
    if (domainCreds.collectMany{ it.value}.empty) {
      return
    }
    def shortenedClassName = store.getClass().name.substring(store.getClass().name.lastIndexOf(".") + 1)
    println "Credentials for store context: ${store.contextDisplayName}, of type $shortenedClassName"
    domainCreds.forEach { domain , creds -&gt;
      println indent("Domain: ${domain.name}", 1)
      creds.each { cred -&gt;
        cred.properties.each { prop, val -&gt;
          println indent("$prop = \"$val\"", 2)
        }
        println indent("-----------------------", 2)
      }
    }
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-14T09:47:20.453Z
Answers: How to modify this to get credentials from all domains, from all folders ?
Answers: jmary
Answers: CC BY-SA 4.0
Answers: 2019-08-15T00:58:17.880Z
Answers: @jmary I have added another example
Answers: Magnus
Answers: CC BY-SA 4.0
Answers: 2019-08-16T09:00:01.393Z
Answers: Great thanks :-)
Answers: jmary
Answers: CC BY-SA 4.0
Answers: 2020-01-17T10:36:20.080Z
Answers: if you want an even simpler oneliner: `com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}`
Answers: ymajoros
Answers: CC BY-SA 4.0
Answers: 2021-10-10T13:20:56.010Z
Answers: In a very old Jenkins implementation replace Jenkins.get() with Jenkins.getActiveInstance()
Answers: guymi
Answers: CC BY-SA 4.0
Answers: 2023-05-24T07:46:48.377Z
Answers: I keep coming back to this again and again, thanks mate!
Answers: Junaid
Answers: CC BY-SA 4.0
Answers: 2019-07-23T23:36:17.910Z
Answers: 2020-04-14T00:58:30.317Z
Answers: 2020-04-14T00:58:30.317Z
Answers: Magnus
Answers: <p>Based on Magnus' answer but as a simple one-liner with still readable output:</p>
  <pre><code>com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-19T11:03:13.177Z
Answers: Short and nice!
Answers: akostadinov
Answers: CC BY-SA 4.0
Answers: 2020-01-17T10:38:42.463Z
Answers: 2022-07-13T08:37:20.113Z
Answers: 2022-07-13T08:37:20.113Z
Answers: ymajoros
Answers: <p>Luckily there is a <code>hudson.util.Secret.decrypt()</code> function which can be used for this, so:</p>
  
  <ol>
  <li>In Jenkins, go to: <code>/script</code> page.</li>
  <li><p>Run the following command:</p>
  
  <pre><code>println(hudson.util.Secret.decrypt("{XXX=}"))
  </code></pre>
  
  <p>or:</p>
  
  <pre><code>println(hudson.util.Secret.fromString("{XXX=}").getPlainText())
  </code></pre>
  
  <p>where <code>{XXX=}</code> is your encrypted password. This will print the plain password.</p>
  
  <p>To do opposite, run:</p>
  
  <pre><code>println(hudson.util.Secret.fromString("some_text").getEncryptedValue())
  </code></pre></li>
  </ol>
  
  <p><sup>Source: <a href="https://gist.github.com/tuxfight3r/eca9442ff76649b057ab" rel="noreferrer">gist at <code>tuxfight3r/jenkins-decrypt.groovy</code></a>.</sup></p>
  
  <hr>
  
  <p>Alternatively check the following scripts: <a href="https://github.com/tweksteen/jenkins-decrypt" rel="noreferrer"><code>tweksteen/jenkins-decrypt</code></a>,
   <a href="https://gist.github.com/menski/8f9980999ed43246b9b2" rel="noreferrer"><code>menski/jenkins-decrypt.py</code></a>.</p>
  
  <hr>
  
  <p>For more details, check: <a href="http://xn--thibaud-dya.fr/jenkins_credentials.html" rel="noreferrer">Credentials storage in Jenkins</a>.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-19T11:13:37.407Z
Answers: +1, for secret files that use `SecretBytes` class, you can see my answer.
Answers: akostadinov
Answers: CC BY-SA 3.0
Answers: 2017-09-28T16:42:49.333Z
Answers: 2017-09-28T22:15:34.657Z
Answers: 2017-09-28T22:15:34.657Z
Answers: kenorb
Body: <p>I've taken over the project where a lot of Jenkins credentials has passwords or passphrase strings which I need to know in order to progress with the project, unfortunately these weren't documented anywhere.</p>
  
  <p>I've checked the <code>credentials.xml</code> file where these credentials are stored, but they're in not plain text, e.g.:</p>
  
  <pre><code>&lt;passphrase&gt;{AAAAAAAAAAAANzxft/rDzyt8mhxpn3O72dxvVqZksL5vBJ4jNKvAjAA=}&lt;/passphrase&gt;
  </code></pre>
  
  <p><sup>Note: I've changed it slightly for privacy reasons.</sup></p>
  
  <p>How can I decrypt its original password based on the string above?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-06-14T17:35:55.460Z
Comments: I am getting error with the proposed answer:
  println(hudson.util.Secret.decrypt("{{xxx/wwww+yyyy/zzzz=}}"))
  The + symbol is breaking the script. Any suggestion?
Comments: Jay Bau
Comments: CC BY-SA 4.0
Comments: 2019-06-17T11:37:28.330Z
Comments: @JayBau Try with single brackets: `"{...}"`, remove extra once.
Comments: kenorb
Comments: CC BY-SA 4.0
Comments: 2020-03-05T09:46:40.913Z
Comments: This is practically a duplicate of an SO question: https://stackoverflow.com/questions/37683143/ (although technically it would only qualify as a duplicate if the linked question was asked on DevOps).
Comments: Attila Csipak
Tags: <jenkins><encryption>
Title: How to decrypt Jenkins passwords from credentials.xml?
UserDisplayName: kenorb
ThreadText: # How to decrypt Jenkins passwords from credentials.xml?
  
  (Asked by: username_0 on 2017-09-28)
  
  I've taken over the project where a lot of Jenkins credentials has passwords or passphrase strings which I need to know in order to progress with the project, unfortunately these weren't documented anywhere.
  
  I've checked the `credentials.xml` file where these credentials are stored, but they're in not plain text, e.g.:
  
  ```
  <passphrase>{AAAAAAAAAAAANzxft/rDzyt8mhxpn3O72dxvVqZksL5vBJ4jNKvAjAA=}</passphrase>
  
  ```
  
  Note: I've changed it slightly for privacy reasons.
  
  How can I decrypt its original password based on the string above?
  
  **Tags:** jenkins, encryption
  
  > **Comments:**
  > **username_1**: I am getting error with the proposed answer: println(hudson.util.Secret.decrypt("{{xxx/wwww+yyyy/zzzz=}}")) The + symbol is breaking the script. Any suggestion?  
  > **username_0**: @username_1 Try with single brackets: `"{...}"`, remove extra once.  
  > **username_2**: This is practically a duplicate of an SO question: https://stackoverflow.com/questions/37683143/ (although technically it would only qualify as a duplicate if the linked question was asked on DevOps).  
  
  ---
  
  ## 5 answers
  
  ### Answer by username_0 on 2017-09-28. Score: 128 | Accepted answer
  
  Luckily there is a `hudson.util.Secret.decrypt()` function which can be used for this, so:
  
  1. In Jenkins, go to: `/script` page.
  2. Run the following command:
  
     ```
     println(hudson.util.Secret.decrypt("{XXX=}"))
  
     ```
  
     or:
  
     ```
     println(hudson.util.Secret.fromString("{XXX=}").getPlainText())
  
     ```
  
     where `{XXX=}` is your encrypted password. This will print the plain password.
  
     To do opposite, run:
  
     ```
     println(hudson.util.Secret.fromString("some_text").getEncryptedValue())
  
     ```
  
  Source: [gist at `tuxfight3r/jenkins-decrypt.groovy`](https://gist.github.com/tuxfight3r/eca9442ff76649b057ab).
  
  ---
  
  Alternatively check the following scripts: [`tweksteen/jenkins-decrypt`](https://github.com/tweksteen/jenkins-decrypt),
  [`menski/jenkins-decrypt.py`](https://gist.github.com/menski/8f9980999ed43246b9b2).
  
  ---
  
  For more details, check: [Credentials storage in Jenkins](http://xn--thibaud-dya.fr/jenkins_credentials.html).
  
  > **Comments:**
  > **username_3**: +1, for secret files that use `SecretBytes` class, you can see my answer.  
  
  ---
  
  ### Answer by username_5 on 2019-07-23. Score: 38
  
  Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text.
  
  ```java
  com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
    it.properties.each { prop, val ->
      if (prop == "secretBytes") {
        println(prop + "=>\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n")
      } else {
        println(prop + ' = "' + val + '"')
      }
    }
    println("-----------------------")
  }
  
  ```
  
  A more complicated version that lists for non-system credential providers:
  
  ```java
  import com.cloudbees.plugins.credentials.CredentialsProvider
  import com.cloudbees.plugins.credentials.Credentials
  import com.cloudbees.plugins.credentials.domains.Domain
  import jenkins.model.Jenkins
  def indent = { String text, int indentationCount ->
    def replacement = "\t" * indentationCount
    text.replaceAll("(?m)^", replacement)
  }
  
  Jenkins.get().allItems().collectMany{ CredentialsProvider.lookupStores(it).toList()}.unique().forEach { store ->
    Map<Domain, List<Credentials>> domainCreds = [:]
    store.domains.each { domainCreds.put(it, store.getCredentials(it))}
    if (domainCreds.collectMany{ it.value}.empty) {
      return
    }
    def shortenedClassName = store.getClass().name.substring(store.getClass().name.lastIndexOf(".") + 1)
    println "Credentials for store context: ${store.contextDisplayName}, of type $shortenedClassName"
    domainCreds.forEach { domain , creds ->
      println indent("Domain: ${domain.name}", 1)
      creds.each { cred ->
        cred.properties.each { prop, val ->
          println indent("$prop = \"$val\"", 2)
        }
        println indent("-----------------------", 2)
      }
    }
  }
  
  ```
  
  > **Comments:**
  > **username_4**: How to modify this to get credentials from all domains, from all folders ?  
  > **username_5**: @username_4 I have added another example  
  > **username_4**: Great thanks :-)  
  > **username_6**: if you want an even simpler oneliner: `com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}`  
  > **username_7**: In a very old Jenkins implementation replace Jenkins.get() with Jenkins.getActiveInstance()  
  > **username_8**: I keep coming back to this again and again, thanks mate!  
  
  ---
  
  ### Answer by username_6 on 2020-01-17. Score: 10
  
  Based on username_5' answer but as a simple one-liner with still readable output:
  
  ```
  com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}
  
  ```
  
  > **Comments:**
  > **username_3**: Short and nice!  
  
  ---
  
  ### Answer by username_3 on 2020-02-19. Score: 5
  
  @username_0 example with `hudson.util.Secret` is good. Also answers listing all credentials are very useful (thanks @username_6 for one-liner).
  
  These do not handle secret files though where `secretBytes` are used and still an encrypted string is shown. In such case the `SecretBytes` class needs to be used. Assuming the file is UTF-8, one can do:
  
  ```java
  secret = "{....}"
  new String(com.cloudbees.plugins.credentials.SecretBytes.fromString(secret).getPlainData())
  
  ```
  
  HTH
  
  **Update:** This is the full solution from [my gits](https://gist.github.com/username_3/d4d695d11b0215c7acc8af5fe82a25bd):
  
  ```java
  com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{
    it.properties.each { prop, val ->
      if (prop == "secretBytes") {
        println(prop + "=>\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n")
      } else {
        println(prop + ' = "' + val + '"')
      }
    }
    println("-----------------------")
  }
  
  ```
  
  
  ---
  
  ### Answer by username_4 on 2019-08-16. Score: 4
  
  For the record, The following snippet to be pasted into the console also does the job :
  
  ```java
  def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
      com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class,
      Jenkins.instance,
      null,
      null
  )
  
  for(c in creds) {
    if(c instanceof com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey){
      println(String.format("id=%s  desc=%s key=%s\n", c.id, c.description, c.privateKeySource.getPrivateKeys()))
    }
    if (c instanceof com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl){
      println(String.format("id=%s  desc=%s user=%s pass=%s\n", c.id, c.description, c.username, c.password))
    }
  }
  
  ```
  
  
  ---
  
  