Bug Days

DBeaver Password Decrypter

Open your own credentials-config.json to recover saved connection usernames and passwords without sending the file to a server. Legacy pre-6.1.3 encrypted password values are supported separately.

DBeaver 6.1.3+ legacy/default storage (credentials-config.json)

1. Locate credentials-config.json:

  • Mac: ~/Library/DBeaverData/workspace6/General/.dbeaver/credentials-config.json
  • Windows: %APPDATA%\DBeaverData\workspace6\General\.dbeaver\credentials-config.json
  • Linux: ~/.local/share/DBeaverData/workspace6/General/.dbeaver/credentials-config.json

2. Upload the file below to decrypt:

3. Correlate with data-sources.json in the same folder to find connection details.

Alternative: OpenSSL Command Line Method

You can also decrypt the credentials file using OpenSSL directly from the command line:

macOS

openssl aes-128-cbc -d \
  -K babb4a9f774ab853c96c2d653dfe544a \
  -iv 00000000000000000000000000000000 \
  -in "$HOME/Library/DBeaverData/workspace6/General/.dbeaver/credentials-config.json" | \
  dd bs=1 skip=16 2>/dev/null

Linux

openssl aes-128-cbc -d \
  -K babb4a9f774ab853c96c2d653dfe544a \
  -iv 00000000000000000000000000000000 \
  -in ~/.local/share/DBeaverData/workspace6/General/.dbeaver/credentials-config.json | \
  dd bs=1 skip=16 2>/dev/null

Generic (any file path)

openssl aes-128-cbc -d \
  -K babb4a9f774ab853c96c2d653dfe544a \
  -iv 00000000000000000000000000000000 \
  -in credentials-config.json | \
  dd bs=1 skip=16 2>/dev/null

How was the key derived?

The key babb4a9f774ab853c96c2d653dfe544a comes from DBeaver's source code, converted to hexadecimal: 

# Python
import struct
struct.pack('<16b', -70, -69, 74, -97, 119, 74, -72, 83, -55, 108, 45, 101, 61, -2, 84, 74).hex()
# Output: 'babb4a9f774ab853c96c2d653dfe544a'
Old DBeaver (Pre 6.1.3) - Text Decryption ▾

1. Locate .dbeaver-data-sources.xml:

  • DBeaver 6.0.3: ~/.dbeaver4/General/.dbeaver-data-sources.xml
  • Older: ~/.dbeaver/General/.dbeaver-data-sources.xml

2. Find encrypted password and paste below:

If this helped you, I'd appreciate a 👍 on my Stack Overflow answer

Recover DBeaver saved credentials safely

Use the matching workspace files

credentials-config.json contains encrypted credential values. The neighboring data-sources.json maps connection IDs to database hosts, ports, drivers, and names, which helps identify each recovered account.

Know the limitation

This recovery method targets DBeaver’s legacy or default fixed-key storage. It cannot bypass a user-defined master password, operating-system secure storage, enterprise password provider, or an encryption scheme that requires a key you do not have.

Keep the result local

The selected file is read with browser APIs and decrypted in this tab. Use this only for credentials you own or are authorized to recover, and clear the page when the recovery is complete.

After identifying a connection, document its database structure with the DDL to ER diagram and data dictionary tool.