How to View and Recover Jenkins Credentials You've Stored

Where Jenkins stores your credentials and why you can't just read them

Jenkins encrypts credentials the moment you save them, so you cannot straightforward open a file and read your username and password back out. The credentials are stored in an encrypted XML file on the Jenkins server, but Jenkins keeps the encryption key separate and does not expose it through the normal interface. This is intentional — it prevents anyone with file access from stealing credentials without also having the master encryption key.

If you need to recover a credential you stored in Jenkins, you have three realistic paths: use the Jenkins Script Console to decrypt and display it, retrieve it from your browser's password manager if Jenkins auto-filled it, or reset it at the source (your Git server, Docker registry, or whatever service the credential connects to) and store the new one in Jenkins.

The Script Console method works only if you have Jenkins administrator access. If you do not, you will need to contact your Jenkins administrator or reset the credential at its source.

Key Takeaways

Jenkins encrypts all stored credentials, so you cannot read them from the file system without the master encryption key.
The Script Console is the fastest way to view a stored credential if you have administrator access to Jenkins.
If you do not have administrator access, ask your Jenkins administrator to retrieve it or reset the credential at its source.
Credentials stored in Jenkins Credentials Store are separate from credentials Jenkins may have auto-filled from your browser.
If you forget a credential entirely, resetting it at the source (GitHub, GitLab, Docker Hub, etc.) and re-entering it in Jenkins is often faster than trying to recover the encrypted version.

Using the Script Console to view a stored credential

The Script Console is a Jenkins feature that lets administrators run Groovy code directly on the Jenkins server. It can decrypt and print credentials to the screen. Open Jenkins, click Manage Jenkins in the left sidebar, then scroll down and click Script Console. You will see a large text box where you can paste code.

Paste this code into the Script Console, replacing my-credential-id with the actual ID of the credential you want to view:

def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class, Jenkins.instance, null, null) creds.each { c -> if (c.id == "my-credential-id") { println("Username: " + c.username) println("Password: " + c.password.plainText) } }

Click Run. The output will appear below the text box and show the username and password in plain text. If the output is empty, the credential ID does not exist or is stored in a different format (SSH key, API token, etc.). For SSH keys, replace StandardUsernamePasswordCredentials with BasicSSHUserPrivateKey and use c.privateKey instead of the password line.

Finding the credential ID if you do not know it

You need the credential ID to use the Script Console method. To find it, go to Manage Jenkins, then click Credentials. You will see a list of credential stores (usually "System" and sometimes others). Click the store where you think the credential is saved.

You will see a table of all credentials in that store. The credential ID is shown in the leftmost column, usually in a smaller font below the credential name. If you see a credential named "GitHub Deploy Key" with the ID "github-deploy-key-prod" below it, that ID is what you paste into the Script Console code.

Recovering a credential from your browser if Jenkins auto-filled it

When you first entered a credential into Jenkins, your browser may have offered to save it. If you said yes, the credential is stored in your browser's password manager, not in Jenkins itself. Open your browser's password manager (usually accessible through Settings or by pressing Ctrl+Shift+B on Windows/Linux or Cmd+Shift+B on Mac), search for the Jenkins URL, and look for the entry that matches the credential you need.

This method only works if you saved the credential in your browser at the time you entered it in Jenkins, and only if you are on the same computer where you originally entered it. It does not retrieve the credential from Jenkins — it retrieves it from your local browser storage.

Resetting the credential at its source instead

If you cannot access the Script Console and do not have the credential saved in your browser, the fastest path is often to reset the credential at the source. For a GitHub personal access token, go to GitHub Settings, find the token in the Developer Settings, and delete it or regenerate it. For a Docker registry password, reset it through the registry's web interface. For an SSH key, you can generate a new one and upload the public key to the server.

Once you have the new credential, return to Jenkins, go to Manage Jenkins > Credentials, find the old credential in the list, click it, and click Update. Paste the new credential value and save. This is usually faster than trying to decrypt the old one, especially if you do not have administrator access to Jenkins.

What to do if you have SSH key credentials instead of username and password

SSH keys are stored differently than username-password pairs. If you stored an SSH key in Jenkins and need to view it, the Script Console code is slightly different. Use this code instead, again replacing my-credential-id with your actual credential ID:

def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(com.cloudbees.plugins.credentials.common.BasicSSHUserPrivateKey.class, Jenkins.instance, null, null) creds.each { c -> if (c.id == "my-credential-id") { println("Username: " + c.username) println("Private Key: " + c.privateKey) } }

The private key will print as a multi-line block of text starting with -----BEGIN RSA PRIVATE KEY----- or similar. Copy the entire block if you need to use it elsewhere. Do not share this output with anyone — a private key is as sensitive as a password.

Preventing this problem in the future

Once you have recovered or reset your credential, consider storing a copy in a password manager like Bitwarden, 1Password, or your browser's built-in password manager. Write down the credential ID you used in Jenkins so you can find it again quickly. If you manage Jenkins for a team, document which credentials are stored where and who has access to reset them if they are lost.

You can also configure Jenkins to use external credential stores like HashiCorp Vault or AWS Secrets Manager instead of storing credentials directly in Jenkins. This adds complexity but gives you a central place to manage and audit all credentials across your infrastructure.

Frequently Asked Questions

Can I view a credential if I do not have administrator access to Jenkins?

No. The Script Console is only available to Jenkins administrators. If you do not have admin access, contact your Jenkins administrator and ask them to retrieve the credential for you, or reset the credential at its source (GitHub, Docker Hub, etc.) and re-enter it in Jenkins yourself.

What if the Script Console code returns nothing?

The credential ID may be wrong, or the credential may be stored in a different format than you expected. Double-check the credential ID by going to Manage Jenkins > Credentials and looking at the exact ID shown in the list. If the ID is correct, the credential may be an API token, SSH key, or other type that requires different code to decrypt.

Is it safe to use the Script Console to view credentials?

Yes, if you trust the Jenkins server and the person running the code. The Script Console runs with full Jenkins permissions, so only administrators should have access to it. Do not paste Script Console code from untrusted sources, as it can read any credential or file on the Jenkins server.

Can I export all credentials from Jenkins at once?

Jenkins does not have a built-in export function for credentials. You can view them one at a time using the Script Console, or you can back up the entire Jenkins home directory (which includes the encrypted credentials file). The backup will be encrypted, so you would still need the master encryption key to decrypt it on another Jenkins instance.

What happens if I lose the Jenkins master encryption key?

You cannot decrypt any stored credentials without the master key. The only recovery path is to reset all credentials at their source and re-enter them in Jenkins. This is why it is important to back up the Jenkins home directory regularly and store the backup in a find location.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.