How to Find a FortiGate VPN Pre-Shared Key (PSK)

Why the GUI Hides the PSK

Fortinet's web GUI masks Pre-Shared Keys with asterisks (•••••••••) as a security precaution. This prevents shoulder-surfing and stops the key being visible in screenshots. There is no "show" button in the GUI — this is by design. The only way to retrieve a plaintext PSK is via the FortiOS CLI using the show command, which requires admin-level access.

If you need the PSK to configure a new VPN endpoint, set up a FortiClient profile, or rebuild a tunnel, the CLI method below will give you the exact value currently stored on the firewall.

Finding the PSK via FortiGate CLI (IPsec)

This is the most reliable method. Connect to your FortiGate via SSH, the web GUI CLI console (System > Dashboard > CLI Console), or serial console, then run:

show vpn ipsec phase1-interface

This outputs the full configuration of all IPsec phase 1 interfaces, including the PSK in plaintext. Look for the set psksecret line under your tunnel name:

config vpn ipsec phase1-interface
    edit "HO-to-Branch"
        set interface "wan1"
        set ike-version 2
        set keylife 86400
        set peertype any
        set net-device disable
        set proposal aes256-sha256
        set dhgrp 14
        set remote-gw 203.0.113.50
        set psksecret ENC YOURPSKWILLAPPEARHERE
    next
end

If the PSK was set with set psksecret and not encrypted with a master key, the value appears after ENC in its stored form. To see the fully decoded PSK, use:

show full-configuration vpn ipsec phase1-interface | grep psksecret

Or to narrow it to a specific tunnel named HO-to-Branch:

show vpn ipsec phase1-interface HO-to-Branch

Finding the PSK in the FortiGate GUI

While the GUI masks the PSK, you can still navigate to the tunnel configuration to confirm it exists and check other settings:

1. Log in to the FortiGate web GUI.
2. Go to VPN > IPsec Tunnels.
3. Click the pencil icon (Edit) next to the tunnel you need.
4. In the Authentication section, the Pre-Shared Key field shows ••••••••• — the actual value is not visible here.
5. You can type a new PSK into this field and click OK to replace it, but you cannot read the existing one from this screen.

For the actual PSK value, use the CLI method above.

IPsec PSK vs SSL-VPN

It's important to understand the difference between IPsec VPN and SSL-VPN on FortiGate — they use different authentication methods:

SSL-VPN does not use a PSK. If users connect via SSL-VPN (the default for FortiClient in most SMB deployments), there is no PSK to find — authentication is username and password, which is managed in User & Authentication > User Definition on the FortiGate.

Finding the PSK on FortiClient

If FortiClient is already configured and connected on a Windows PC, the PSK is stored locally but also not displayed in the GUI. You have two options:

Option 1 — Export the FortiClient configuration:

1. Open FortiClient on the Windows machine.
2. Go to File > Backup (or Settings > Backup on newer versions).
3. Save the configuration as an XML file.
4. Open the XML in Notepad or a text editor and search for psk or psksecret. The value may be obfuscated in older FortiClient versions.

Option 2 — Read from the Windows registry:

FortiClient stores VPN profile data in the Windows registry. Open Registry Editor (regedit) and navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\Sslvpn\Tunnels

Or for IPsec tunnels:

HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\Ipsec\Tunnels

PSK values stored here may be base64-encoded or encrypted. The most reliable approach remains retrieving the PSK directly from the FortiGate CLI.

How to Change the PSK

If you need to rotate the PSK (recommended after any staff change or security incident), update it on the FortiGate first, then on every endpoint:

config vpn ipsec phase1-interface
    edit "HO-to-Branch"
        set psksecret NewStrongPSKHere123!
    next
end

After changing the PSK on the FortiGate, update the PSK on the remote end (the other firewall or VPN client) before the existing tunnel expires, or manually bring the tunnel down and up to force renegotiation.

Need Help?

Melbits provides managed IT support for Melbourne businesses, including FortiGate VPN configuration, IPsec tunnel troubleshooting, and FortiClient deployment. If you're locked out or need VPN credentials recovered, contact us for remote support. Call 1800 635 248 or get in touch online.