Decrypting Jenkins Passwords (Bookmarklet & Groovy Console)

⚠️ Security Warning:
This technique requires administrative privileges in Jenkins (Administer access to the Groovy Script Console). Use this method strictly for legitimate administrative recovery in controlled environments.

In legacy Jenkins instances, system administrators may occasionally need to recover a password or token stored in the Jenkins Credentials Store that is masked by default (••••••••).

🛠️ Extraction Bookmarklet

You can create a browser bookmarklet using the following JavaScript snippet:

javascript:(function(){
  var passwordInput = document.querySelectorAll('input[type="password"]')[0];
  if (!passwordInput) {
    alert('No password input field found on this page.');
    return;
  }
  var encryptedPassword = passwordInput.value;
  prompt(
    'Copy the Groovy script below and run it in /script (Jenkins Groovy Console):',
    'println( hudson.util.Secret.decrypt("' + encryptedPassword + '") )'
  );
  location.href = '/script';
})();

📋 Step-by-Step Instructions

1. Navigate to the Jenkins Credentials Update Page where the target secret field is rendered.
2. Click your browser bookmarklet.
3. The script extracts the encrypted payload string and formats a Groovy decryption invocation.
4. Paste the generated line into the Jenkins Script Console (/script) and click Run.
5. Jenkins uses its internal master key (master.key / hudson.util.Secret) to decrypt and print the plaintext password.

🔐 Modern Secrets Management Best Practices

Storing long-lived static credentials directly inside Jenkins increases maintenance overhead and risk. Modern CI/CD architecture favors dynamic credentials:

• Dedicated Secrets Managers: Integrate Jenkins with HashiCorp Vault, Azure Key Vault, or AWS Secrets Manager using short-lived tokens.
• OIDC & Workload Identity: Eliminate static API keys by employing OpenID Connect (OIDC) federation between your CI/CD runner and cloud provider.