Showing root credentials
How to see the root username and password saved in the panel, and why the password shown may be out of date.
On this page
The “Reveal credentials” button shows the root username and password that the app.blackbox.md panel has saved for your server. The button is on the server card, on the “My Servers” page (app.blackbox.md/my-servers, sidebar → “Infrastructure” → “My Servers”). From blackbox.md you can go straight to the card through “Contul meu” (My account) → “Comenzi” (Orders) → “Gestionează în app.blackbox.md” (Manage in app.blackbox.md).
Available to: the blackbox.md account holder who ordered the server, or an account that BLACKBOX has given management rights for the server. Cards marked “Managed” don't show the button.
The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.
How to show the credentials
- Sign in to the panel (see Opening the app.blackbox.md panel from your account) and open “My Servers”.
- Find the server card by its name or by the “IP” field.
- Click “Reveal credentials”.
- The browser asks you to confirm: “Reveal stored credentials for SERVER_NAME? This access is logged.”, where SERVER_NAME is the name shown on the card. Click “OK”. If you cancel, nothing is shown and nothing is logged.
- A box appears on the card with “Username” (
rootfor servers ordered on blackbox.md) and “Password”.
The box stays on the card until you reload the page or go to another page of the panel. It has no copy button: select the password with your mouse from the first character to the last and copy it (Ctrl+C, or Cmd+C on macOS). Double-clicking may select only part of the password if it contains -. The same box also shows the new password after you click “Reset password”.
With these credentials, you connect over SSH to the address in the “IP” field:
ssh root@SERVER_IPWhen the terminal asks for the password, paste it and press Enter; the characters don't appear on the screen. Instructions for each system: Connecting to your server over SSH (Windows, macOS, Linux).
Why the password shown may be out of date
Important The panel shows the password it has saved; it doesn't read it from the server. If you changed the root password directly on the server, for example with the
passwdcommand, the box still shows the old password, which no longer works.
The panel knows the password set when the server was created and any password generated later with “Reset password”. To have a password the panel knows again:
- On the same card, click “Reset password” and confirm.
- The panel sets a new password on the server and shows it in the same box. From that moment on, the old password no longer works.
The conditions and errors of a reset are described in Resetting the root password. When you want to change the root password, use “Reset password” instead of the passwd command: that way, the password in the panel stays correct.
“Key-only” servers
The badge next to the server name shows whether the password can be used for SSH:
| Badge | What it means for the password shown |
|---|---|
| “Password + key” | You can connect over SSH with either the password or an installed SSH key. |
| “Key-only” | The server has a root password and the panel shows it, but SSH password login is disabled. You can connect only with your SSH key. |
On a “Key-only” server, an attempt to connect with the password usually ends with the message Permission denied (publickey). The password works over SSH only after you turn password login back on with the “Enable password login” button (see Enabling and disabling SSH password login). If you can connect with your key without problems, leave password login disabled: it is the safer option.
The panel has no web or VNC console for customers. If you no longer have your key and can't connect, read Lost access to your server (password or key).
Every reveal is logged
Each successful reveal records the account, the date and time, the IP address and the browser from which the credentials were requested. You can't view this log in the panel. If you suspect that someone else has seen your password, click “Reset password”, change your account password (see Changing your account password) and write to us (see How to contact BLACKBOX support).
An AI assistant connected through MCP can also show the same credentials, but only if its token has the “Vizualizează parolele/accesul serverelor” (View server passwords/access) permission (servers:credentials). These reveals are logged too. Details: Token permissions (scopes).
Limit and error messages
You can show credentials at most 20 times per minute, for all the servers in your account combined. Failed attempts count too, including those rejected because of the limit. Errors appear in a red box on the card.
| Message | What it means | What to do |
|---|---|---|
| “Rate limit exceeded — credentials view is limited to 20 requests per 60 seconds” | You have exceeded 20 reveals in one minute. | Wait a minute without clicking the button, then try again. |
| “No credentials stored for this server” | The panel has no saved credentials for this server. | Write to support. |
| “Failed to decrypt credentials — encryption key may have changed” | The saved credentials can't be read. | Write to support. |
| “Failed to reveal credentials.” or another technical message | The request failed. | Reload the page and try again. If the error repeats, write to support. |
Keep the password safe
Security Anyone who gets into your account can see the root password of your servers. Protect your account with a strong password and turn on two-factor authentication (see Two-factor authentication (2FA) in the panel).
- Don't share the password, and don't send it by email or through messaging apps.
- Don't take screenshots of the box with the password.
- Keep the password in a password manager.
- After you copy the password, reload the page so that the box disappears, especially if your screen is shared or visible to others.
- Prefer SSH keys: see Generating an SSH key (Windows, macOS, Linux) and Adding and removing SSH keys on the server. Once you can connect with your key without problems, you can disable password login.
Frequently asked questions
The password shown doesn't work. What should I check? If the server has the “Key-only” badge, SSH doesn't accept passwords: connect with your key. If you changed the password on the server, use “Reset password”. Also check that you copied the whole password, with no spaces at the beginning or end.
Can I show the password when the server is stopped? Yes. The panel shows the saved credentials and doesn't connect to the server. “Reset password”, however, works only when the server is running.
Why don't I see the “Reveal credentials” button? The card has the “Managed” badge and the message “This server is looked after by our team. To request a change, please contact support.” For access, write to support. If the server doesn't appear at all, read The “My Servers” page: the server card.
Can the saved password change by itself? No. It changes only when someone clicks “Reset password” in the panel, or when an AI assistant with the “Vizualizează parolele/accesul serverelor” (View server passwords/access) permission resets the password.