enable secret vs enable password: What Is the Difference?
Use enable secret. It stores the privileged-EXEC password as a hash, so it cannot be read back from the config. enable password stores it in plaintext (or with the trivially reversible Type 7 cipher) and is only kept for legacy compatibility. If both are set, the router ignores enable password entirely and uses enable secret.
The core difference
Both commands set the password that takes you from user-EXEC mode (Router>) into privileged-EXEC mode (Router#). What differs is how that password is stored.
| enable password | enable secret | |
|---|---|---|
| Storage | Plaintext in running-config | One-way hash |
| Default hash | None (Type 0) | MD5 (Type 5), or SHA-256 (Type 8/9) on modern IOS |
| Reversible? | Yes — trivially | No — must be brute-forced |
| Precedence | Ignored if secret is set | Always wins |
| Use it today? | No | Yes |
The takeaway is simple: an attacker who gets a copy of your config file — from a TFTP backup, an email attachment, or a screenshot — reads your enable password instantly. They cannot read your enable secret.
Configuring it
Set the secret in global configuration mode:
Router> enable
Router# configure terminal
Router(config)# enable secret MyStr0ngSecret
Router(config)# no enable password
Router(config)# service password-encryption
Router(config)# end
Router# copy running-config startup-configThree things are happening there:
- enable secret sets the hashed privileged-mode password.
- no enable password removes the legacy plaintext one so it cannot linger in the config.
- service password-encryption applies Type 7 encryption to other plaintext passwords (console, VTY lines). It is weak obfuscation, not real encryption — but it stops shoulder-surfing.
Verify with show running-config. You should see a long hash, never your actual password.
What the config looks like
With only enable password set, anyone reading the config sees this:
enable password Cisco123With enable secret, they see this instead:
enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0The 5 is the hash type. On newer IOS versions you can force a stronger algorithm:
Router(config)# enable algorithm-type sha256 secret MyStr0ngSecretThat produces a Type 8 hash, which is far more resistant to offline cracking than the old Type 5 MD5.
A note on Type 7
You will often see passwords in a config that look encrypted, like password 7 08701E1D5D4C53. This is Type 7, produced by service password-encryption. It is not secure — it is a Vigenère cipher with a published key, and dozens of free tools decode it in under a second.
Treat Type 7 as obfuscation only. It protects against someone glancing at your screen. It does not protect against anyone who obtains the config file. This is precisely why enable secret exists and why it is the only correct choice for the privileged-mode password.
Exam and interview tips
This comes up constantly in CCNA and in junior interviews. The points examiners look for:
enable secrettakes precedence when both are configured.enable secretis hashed;enable passwordis plaintext.service password-encryptiondoes not upgradeenable passwordto a secure hash — it only applies weak Type 7.- Type 7 is reversible; Type 5/8/9 are not.
- Best practice is to configure
enable secret, removeenable password, and protect the VTY lines with SSH rather than Telnet.
For the full command set, see our Cisco commands reference.
Frequently asked questions
Which is more secure, enable secret or enable password?
enable secret. It stores the password as a one-way hash, while enable password stores it in plaintext or weak Type 7 encryption that can be decoded in seconds.
What happens if I configure both?
The router uses enable secret and completely ignores enable password. The plaintext one still sits in the config, though, so you should remove it with 'no enable password'.
Does service password-encryption make enable password safe?
No. It only applies Type 7 encryption, which is reversible with freely available tools. It is obfuscation, not security. Use enable secret instead.
Can enable secret be decrypted?
No. It is a one-way hash (MD5 Type 5, or SHA-256 Type 8 on modern IOS). It can only be attacked by brute force, which is why a long, strong password still matters.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.