August 6, 2026
Password drama from the mainframe crypt
The Cipher Behind Qsyrupwd: Reconstructing IBM i Password Hashes
Old IBM password secrets got cracked open — and the comments loved the nerd chaos
TLDR: A researcher found that newer IBM i systems store password data in a way that breaks the usual testing tools, then reverse-engineered what was going on. The community reaction was mostly delighted awe: deeply nerdy, unexpectedly readable, and a reminder that old business computers still matter a lot.
A dusty corner of big-business computing just got a surprise moment in the spotlight, and the crowd reaction is basically: this is outrageously nerdy, and we are seated. The article digs into how an IBM i system tool meant to hand over passwords in a protected form actually behaves on newer settings — and the big reveal is that modern versions don’t line up with the usual password-testing tools people expected. In plain English: a security researcher went looking for an easy way to test password strength on an old-school IBM business machine, discovered the usual trick no longer worked, and then went full detective mode to figure out why.
What made the comment section pop wasn’t a giant flame war — it was the sheer delight at watching someone go way too deep into enterprise-computer archaeology. The standout reaction from a2tech summed up the mood perfectly: this was "more than I ever wanted to know," but also "A+ nerd" material. That’s the vibe here: equal parts admiration, intimidation, and amused disbelief that someone voluntarily spelunked through the guts of a password system from IBM’s famously ancient-but-still-everywhere business platform.
The hottest take, if there is one, is that this kind of research matters because these older systems still run payroll, factories, and logistics. So while the jokes write themselves — think "Indiana Jones, but for password vaults" — the subtext is serious: old tech still holds very modern power, and the community clearly respects anyone brave enough to decode its secrets.
Key Points
- •The article examines IBM i’s QSYRUPWD API, which returns encrypted password-related data for authorized administrative use cases such as synchronization, migration, and replication.
- •It explains that IBM i password behavior is governed by QPWDLVL, with levels 0–1 tied to DES-based schemes, 2–3 to SHA-1-based schemes, and 4 to a PBKDF2-based verifier model.
- •The author reports that QSYRUPWD output from systems running QPWDLVL 2–4 did not match the input format expected by John the Ripper’s IBM i cracking modules.
- •According to the article, legacy QPWDLVL 0–1 output remained compatible with John the Ripper formats such as `as400_des` and `as400_ssha1`.
- •To verify the behavior, the author created a small CL program that calls QSYRUPWD with the `UPWD0100` format and captures the returned buffer for analysis.