Extracting Credentials From Jenkins

This describes how to recover a credential from Dashboard → Manage Jenkins → Credentials. Jenkins normally hides the password that was provided when the entry was created, but the value is stored (encrypted) on disk and can be decrypted.

Step 1: Get the encrypted credential #

On the Jenkins host, the credentials live in credentials.xml under the Jenkins home directory:

cd "$JENKINS_HOME"   # Usually /var/lib/jenkins
cat credentials.xml | grep gitlab-ssh-private-key -C 5

This prints some XML. Look for an entry like:

<secret>{bgfhdh435agdfg}</secret>

The surrounding tag depends on the credential type — it may be <password>, <privateKey>, <secret>, etc.

Step 2: Decrypt it #

You can decrypt manually using the contents of files like secrets/master.key, but the easiest route is the Jenkins script console: go to Dashboard → Manage Jenkins → Script Console and run:

println( hudson.util.Secret.decrypt("{bgfhdh435agdfg}") )

If everything is correct, this prints the decrypted private key or password.