Remote repositories in Artifactory may be configured with credentials (username/password) to authenticate against upstream sources. These passwords are stored in encrypted form and are displayed as encrypted in the UI, in REST API responses, and in the config file (artifactory.repository.config.latest.json).
If you need to retrieve the original plain-text password (for example, to migrate a remote repository to a new instance, or to verify the credentials are correct), you can temporarily decrypt all passwords using the Artifactory Key Encryption REST API.
Where Are Passwords Stored?
They are reflected in two config files under $JFROG_HOME/artifactory/var/etc/artifactory/:
- artifactory.repository.config.latest.json contains repository definitions, including remote repository upstream passwords. Passwords in this file always remain encrypted regardless of the decrypt/encrypt API state - the decrypt API only affects what the REST API returns.
- artifactory.config.latest.xml contains global settings such as push replication passwords, LDAP bind passwords, and proxy passwords. Passwords in this file are also decrypted when the decrypt API is called, and re-encrypted with a new hash after re-encrypting.
Steps to Retrieve the Password
1. Deactivate Key Encryption (Decrypt)
Run the following REST API call as an admin user:
curl -u <admin-user>:<password> -X POST "https://<server>/artifactory/api/system/decrypt"
2. Retrieve the Remote Repository Configuration
Query the repository configuration:
curl -u <admin-user>:<password> "https://<server>/artifactory/api/repositories/<repo-key>"
The password field in the response will now appear in plain text instead of the JE2... encrypted form.
For push replication passwords, query the replication API:
curl -u <admin-user>:<password> "https://<server>/artifactory/api/replications/<repo-key>"
Alternatively, you can check the artifactory.config.latest.xml file, where the password will be displayed in plain text.
3. Re-Activate Key Encryption (Encrypt)
After retrieving the password, re-encrypt using this REST API:
curl -u <admin-user>:<password> -X POST "https://<server>/artifactory/api/system/encrypt"