How to recover WebLogic admin password from boot.properties file

A friend came to me with a kind of locked out WebLogic 8.1 domain. He could still start the server but he didn't know the password for admin console. The fact that he could still start the server was because the username and password are stored in the boot.properties under domain directory. But they are encrypted. I told my friend that the password in the boot.properties must be a reversible as WebLogic itself needs the password to start the server. We searched string "boot.properties" in all the class files in the weblogic.jar file to find the class that does the magic. It's weblogic.security.internal.BootProperties. After 2 hours of try, we end up with code below:

import weblogic.security.internal.BootProperties;

public class RecoverPassword { 

  public static void main(String[] args) { 
    BootProperties.load(null, false);  // tested with 8.1

    // BootProperties.load("fullPathToBootPropertiesFile", false); // tested with 10.3
    BootProperties bootp = BootProperties.getBootProperties(); 

    System.out.println( 
      "#####################[" + 
       bootp.getOneClient() + "/" + bootp.getTwoClient() + 
       "]###################"); 
  }

}

Update 6/20/2009: Since many people asked me about later version of WebLogic. I took a look at the latest version 10.3 as of today. It turned out that BEA changed it a little bit. My original code, which was written for 8.1, throws the NullPointerException. But the fix is also simple, just change the call to BootProperties.load by giving the path to the boot.properties file.

We placed the above RecoverPassword.java file in c:\recover directory and compiled it. Then made a copy of startWebLogic.cmd to C:\recover\recoverPassword.cmd and added a few lines to it, nearly the end of file(first and last are existing lines).

%JAVA_HOME%\bin\java %JAVA_VM% -version
SET CLASSPATH=C:\recover;%CLASSPATH% echo %CLASSPATH%
SET SERVER_CLASS=RecoverPassword
SET doExitFlag=false
if "%WLS_REDIRECT_LOG%"=="" (

Now cd to the domain home and execute c:\recover\recoverPassword, we have the password back :-)