Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have hosting service hosted on more than 20+ Plesk servers, version 11. As in the previous versions, the passwords were not encrypted, then if i had to design some tools to manage the hosting accounts, i just picked up the cleartext passwords from the Database. but as now the passwords are encrypted, is there any way i can decrypt the passwords? through API or any other way so that i can integrate my php based hosting management with plesk 11?

share|improve this question
up vote 9 down vote accepted

The code provided by Giulio isn't helpful, here's a Python script that actually works. Requires PyCrypto (python-crypto). Assumes that Plesk secret key is stored at /etc/psa/private/secret_key. Just run it and pass in encrypted passwords as arguments:

./ '$AES-128-CBC$T82uDt6NSdytfhjQaOIKGg==$CMJ6FIdAD8zJ0PgwQ3DosA=='


#!/usr/bin/env python
import sys
import base64
from Crypto.Cipher import AES

key = open('/etc/psa/private/secret_key', 'rb').read()

for pw in sys.argv[1:]:
    lead, typ, iv, ct = pw.split('$')
    iv = base64.b64decode(iv)
    ct = base64.b64decode(ct)
    assert typ == 'AES-128-CBC'
    plain =, mode=AES.MODE_CBC, IV=iv).decrypt(ct).rstrip(b'\0')
share|improve this answer
I can confirm this works with Plesk 11.5 – Jon Nov 4 '13 at 15:20
Don't forget single quotes around passsword otherwise you'll get a "ValueError: need more than 2 values to unpack" – bleemboy Sep 7 '15 at 10:27
Not always working btw... with this password $AES-128-CBC$05M0XNpwbg6UzMV7nSj2qw==$d6vcsC92Ly2dlGhXS0372w== or this password $AES-128-CBC$KEKiihkO0Kjm+Nc+3BthBQ==$R8MJan9e1KLzTL6+FsCUxg== you'll get a ValueError: need more than 1 values to unpack" – bleemboy Sep 7 '15 at 10:50
the code above does not appear to work. – Turgut Kalfaoglu Sep 11 '15 at 15:31

Why not just figure out what hashing algorithm Plesk uses, and replicate that functionality in your PHP application? You don't need the un-ecrypted version of a password to authenticated against it, and you never really want to store a password in the clear, or with a reversible encryption.

share|improve this answer
Agreed. It is a BAD idea to store passwords in plaintext. – David W Sep 6 '12 at 22:35
Thirded, you should be working with hashes of the passwords rather than trying to decrypt passwords and hack something together. Going the original route introduces a ton of unnecessary risk. – bobmagoo Sep 7 '12 at 13:49

Theoretically, if the program can get the encryption password, yes, you can get back the password in plain text.
EDIT: added decryption code.

function decrypt_password($pass,$key)

$base64encoded_ciphertext = $pass;

$res_non = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, base64_decode($base64encoded_ciphertext), ‘ecb’);

$decrypted = $res_non;
$dec_s2 = strlen($decrypted);

$padding = ord($decrypted[$dec_s2-1]);
$decrypted = substr($decrypted, 0, -$padding);

return  $decrypted;
share|improve this answer
Password are encrypted with AES-128-CBC cypher . so possible to get password from them? – Farhan Sep 7 '12 at 9:40
Please review my answer, I've posted the code. – Giulio Muscarello Sep 7 '12 at 13:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.