# How to find out the credentialSecret
**URL:** https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729
**Category:** General
**Tags:** security
**Created:** [23 April 2025 21:17 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729 "2025-04-23T21:17:28Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@toony1906](https://discourse.nodered.org/u/toony1906)
#### Post date: [23 April 2025 21:17 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/1 "2025-04-23T21:17:28Z")
Hi everyone,
I'm a bit new to Node Red and unfortunately I used a password in a config node which can't be reset and so I thought maybe I can decrypt the flows\_cred.json, for that I would need the credentialSecret. I have never set a user or password when starting Node Red. In settings.js it only says “admin” and in .config.runtime.json I couldn't find it either.
I hope you can help me with this.
Thanks in advance, best regards
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [23 April 2025 21:24 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/2 "2025-04-23T21:24:39Z")
It seems this suggestion doesn't apply on Windows - deleted.
---
### Author:  [@omrid](https://discourse.nodered.org/u/omrid)
#### Post date: [23 April 2025 21:26 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/3 "2025-04-23T21:26:47Z")
Unless you set it implicitly in **settings.js** , you should be able to find an auto-generated credentialSecret in `.config.runtime.json` in your node-red user (home) directory
---
### Author:  [@toony1906](https://discourse.nodered.org/u/toony1906)
#### Post date: [23 April 2025 21:45 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/4 "2025-04-23T21:45:24Z")
@omrid
Thanks for your quick reply, unfortunately I only have the following in .config.runtime.json
```auto
{
"instanceId": "aecf556ec9c47e38"
}
```
---
### Author:  [@E1cid](https://discourse.nodered.org/u/E1cid)
#### Post date: [23 April 2025 21:50 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/5 "2025-04-23T21:50:04Z")
Nevermind i midd read the question.
I would think if you never set a secret, then may be setting one and restarting node-red may encrypt to the new secret.
~~This could should decrypt the credential file and show all item in the console, creat a file called show\_creds.js with below code in your .node-red directory. Then run the command comment in first line in that directory.~~
```auto
// run "node show_creds flows_cred.json " in node-red directoy
const crypto = require('crypto');
let encryptionAlgorithm = "aes-256-ctr";
function decryptCreds(key, cipher) {
let flows = cipher["$"];
lry initVector = Buffer.from(flows.substring(0, 32),'hex');
flows = flows.substring(32);
let decipher = crypto.createDecipheriv(encryptionAlgorithm, key, initVector);
let decrypted = decipher.update(flows, 'base64', 'utf8') + decipher.final('utf8');
return JSON.parse(decrypted);
}
let creds = require("./" + process.argv[2]);
let secret = process.argv[3];
let key = crypto.createHash('sha256').update(secret).digest();
console.log(decryptCreds(key, creds));
```
---
### Author:  [@toony1906](https://discourse.nodered.org/u/toony1906)
#### Post date: [23 April 2025 22:24 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/6 "2025-04-23T22:24:41Z")
The problem I seem to have is that I have not set a credentialSecret and cannot find one in .config.runtime.json. If I now set one manually and restart Node Red I only get the message that all passwords are gone when I deploy something. That's not the way, is it?
A credentialSecret must be stored somewhere, otherwise Node Red itself would not be able to decrypt the flows\_cred.json, but where?
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [24 April 2025 09:51 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/7 "2025-04-24T09:51:08Z")
Are you sure that you don't have a `credentialSecret` property in settings.js?
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [23 July 2025 09:51 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729/8 "2025-07-23T09:51:11Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.