I'm gonna use Spoon to transfer data from Postgres to MSSQL. I see that when we create connection its data is stored and we don't need to type password anymore.

But I can't find where it stores this data. I looked on ktr file and didn't find username on it.

I searched how it's stored but found no info. I can't approve its use without knowing that the password is securely stored and a hacker won't retrieve it.

Update: I found on the ktr XML file where login is saved, and password is saved encrypted. Is it secure?

I didn't see a private key being used to encrypt it. If it's using some synchronous key encryption, isn't anybody able to decrypt it? It may be even worse to have an encryption that's easy to decrypt than no encryption at all.

1 Answer 1


The encryption used by Spoon for passwords is not secure.

You can use a User Defined Java Expression step in a Pentaho transformation to decrypt it:

New field: decrypted_password

Java expression: import org.pentaho.di.core.encryption.Encr;Encr.decryptPassword(encrypted_password)

Value type: String

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.