As I was already using the Hadoop Credential Provider, I found a solution that does not require decrypting the password as follows: PySpark code: # Spark session spark = SparkSession.builder \ .config("spark.yarn.keytab=/etc/security/keytabs/<APPLICATION_USER>.keytab") \ .appName('SPARK_TEST') \ .master("yarn") \ .getOrCreate() credential_provider_path = 'jceks://hdfs/<PATH>/<CREDENTIAL_FILE>.jceks' credential_name = 'PASSWORD.ALIAS' # Hadoop credential conf = spark.sparkContext._jsc.hadoopConfiguration() conf.set('hadoop.security.credential.provider.path',credential_provider_path) credential_raw = conf.getPassword(credential_name) for i in range(credential_raw.__len__()): password = password + str(credential_raw.__getitem__(i)) The important point above is the .config() line in SparkSession. You must enter the keytab to access the password. Otherwise you will get the encrypted value. I can't say that I'm very happy with being able to directly manipulate the password value in the code. I would like to delegate this to some component in a way that the programmer does not have direct access to the password value. Maybe what I'm looking for is some kind of authentication provider, but for now the solution above works for me. ... View more