diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnel.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnel.java
index bbfe9378d09f64e294384d4d9b86813c1f8764a4..e28f34fbb1a58c779d771eadacd50e9192ce2c63 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnel.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnel.java
@@ -1376,8 +1376,8 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
      */
     private void runAuth(String args[], Logging l) {
         if (args.length == 2) {
-            _clientOptions.setProperty("i2cp.username", args[0]);
-            _clientOptions.setProperty("i2cp.password", args[1]);
+            _clientOptions.setProperty(I2PClient.PROP_USER, args[0]);
+            _clientOptions.setProperty(I2PClient.PROP_PW, args[1]);
         } else {
             l.log("Usage:\n" +
                   "  auth <username> <password>\n" +
@@ -1655,9 +1655,9 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
             notifyEvent("lookupResult", "invalidUsage");
         } else {
             try {
-                boolean ssl = Boolean.parseBoolean(_clientOptions.getProperty("i2cp.SSL"));
-                String user = _clientOptions.getProperty("i2cp.username");
-                String pw = _clientOptions.getProperty("i2cp.password");
+                boolean ssl = Boolean.parseBoolean(_clientOptions.getProperty(I2PClient.PROP_ENABLE_SSL));
+                String user = _clientOptions.getProperty(I2PClient.PROP_USER);
+                String pw = _clientOptions.getProperty(I2PClient.PROP_PW);
                 Destination dest = destFromName(args[0], host, port, ssl, user, pw);
                 if (dest == null) {
                     l.log("Unknown host: " + args[0]);
@@ -1777,18 +1777,18 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
             System.out.println("Invalid b32 " + name + " - " + iae);
             return;
         }
-        boolean ssl = Boolean.parseBoolean(_clientOptions.getProperty("i2cp.SSL"));
-        String user = _clientOptions.getProperty("i2cp.username");
-        String ipw = _clientOptions.getProperty("i2cp.password");
+        boolean ssl = Boolean.parseBoolean(_clientOptions.getProperty(I2PClient.PROP_ENABLE_SSL));
+        String user = _clientOptions.getProperty(I2PClient.PROP_USER);
+        String ipw = _clientOptions.getProperty(I2PClient.PROP_PW);
         I2PClient client = new I2PSimpleClient();
         Properties opts = new Properties();
         opts.put(I2PClient.PROP_TCP_HOST, host);
         opts.put(I2PClient.PROP_TCP_PORT, port);
-        opts.put("i2cp.SSL", Boolean.toString(ssl));
+        opts.put(I2PClient.PROP_ENABLE_SSL, Boolean.toString(ssl));
         if (user != null)
-            opts.put("i2cp.username", user);
+            opts.put(I2PClient.PROP_USER, user);
         if (ipw != null)
-            opts.put("i2cp.password", ipw);
+            opts.put(I2PClient.PROP_PW, ipw);
         I2PSession session = null;
         try {
             session = client.createSession(null, opts);
@@ -2029,11 +2029,11 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
                 opts.put(I2PClient.PROP_TCP_HOST, i2cpHost);
             if (i2cpPort != null)
                 opts.put(I2PClient.PROP_TCP_PORT, i2cpPort);
-            opts.put("i2cp.SSL", Boolean.toString(isSSL));
+            opts.put(I2PClient.PROP_ENABLE_SSL, Boolean.toString(isSSL));
             if (user != null)
-                opts.put("i2cp.username", user);
+                opts.put(I2PClient.PROP_USER, user);
             if (pw != null)
-                opts.put("i2cp.password", pw);
+                opts.put(I2PClient.PROP_PW, pw);
             I2PSession session = null;
             try {
                 session = client.createSession(null, opts);
diff --git a/core/java/src/net/i2p/client/I2PClient.java b/core/java/src/net/i2p/client/I2PClient.java
index c2133a53035d10973ea3fdedccbc33bfd0145b2f..24bad23452e2601f47360870a23775195570ec6c 100644
--- a/core/java/src/net/i2p/client/I2PClient.java
+++ b/core/java/src/net/i2p/client/I2PClient.java
@@ -64,6 +64,13 @@ public interface I2PClient {
      */
     public final static String PROP_FAST_RECEIVE = "i2cp.fastReceive";
 
+    /** @since 0.9.44, was protected in I2PSessionImpl */
+    public static final String PROP_ENABLE_SSL = "i2cp.SSL";
+    /** @since 0.9.44, was protected in I2PSessionImpl */
+    public static final String PROP_USER = "i2cp.username";
+    /** @since 0.9.44, was protected in I2PSessionImpl */
+    public static final String PROP_PW = "i2cp.password";
+
     /**
      *  7654
      *  @since 0.9.38
diff --git a/core/java/src/net/i2p/client/impl/I2CPMessageProducer.java b/core/java/src/net/i2p/client/impl/I2CPMessageProducer.java
index e08bf4e51d2ccc66a5d19acf0d7db057c5857afa..5564747c35a569b8b5255bcd0fece8c7d8a25e35 100644
--- a/core/java/src/net/i2p/client/impl/I2CPMessageProducer.java
+++ b/core/java/src/net/i2p/client/impl/I2CPMessageProducer.java
@@ -66,7 +66,7 @@ class I2CPMessageProducer {
         "i2cp.closeIdleTime", "i2cp.closeOnIdle", "i2cp.encryptLeaseSet",
         "i2cp.gzip", "i2cp.leaseSetKey", "i2cp.leaseSetPrivateKey",
         "i2cp.leaseSetSigningPrivateKey", "i2cp.reduceIdleTime", "i2cp.reduceOnIdle",
-        I2PSessionImpl.PROP_ENABLE_SSL, I2PClient.PROP_TCP_HOST, I2PClient.PROP_TCP_PORT,
+        I2PClient.PROP_ENABLE_SSL, I2PClient.PROP_TCP_HOST, I2PClient.PROP_TCP_PORT,
         // long and shouldn't be passed through
         "i2p.reseedURL"
     };
diff --git a/core/java/src/net/i2p/client/impl/I2PSessionImpl.java b/core/java/src/net/i2p/client/impl/I2PSessionImpl.java
index e379b093fae732ed8cc17cee49c91719d1c73690..563292a7fa93b4d2405c08bc275bd2655a28b680 100644
--- a/core/java/src/net/i2p/client/impl/I2PSessionImpl.java
+++ b/core/java/src/net/i2p/client/impl/I2PSessionImpl.java
@@ -211,11 +211,6 @@ public abstract class I2PSessionImpl implements I2PSession, I2CPMessageReader.I2
     private static final Map<Object, Destination> _lookupCache = new LHMCache<Object, Destination>(CACHE_MAX_SIZE);
     private static final String MIN_HOST_LOOKUP_VERSION = "0.9.11";
 
-    /** SSL interface (only) @since 0.8.3 */
-    protected static final String PROP_ENABLE_SSL = "i2cp.SSL";
-    protected static final String PROP_USER = "i2cp.username";
-    protected static final String PROP_PW = "i2cp.password";
-
     /**
      * Use Unix domain socket (or similar) to connect to a router
      * @since 0.9.14
@@ -431,12 +426,12 @@ public abstract class I2PSessionImpl implements I2PSession, I2CPMessageReader.I2
         // auto-add auth if required, not set in the options, and we are not in the same JVM
         if ((!_context.isRouterContext()) &&
             _context.getBooleanProperty("i2cp.auth") &&
-            ((!opts.containsKey(PROP_USER)) || (!opts.containsKey(PROP_PW)))) {
-            String configUser = _context.getProperty(PROP_USER);
-            String configPW = _context.getProperty(PROP_PW);
+            ((!opts.containsKey(I2PClient.PROP_USER)) || (!opts.containsKey(I2PClient.PROP_PW)))) {
+            String configUser = _context.getProperty(I2PClient.PROP_USER);
+            String configPW = _context.getProperty(I2PClient.PROP_PW);
             if (configUser != null && configPW != null) {
-                options.setProperty(PROP_USER, configUser);
-                options.setProperty(PROP_PW, configPW);
+                options.setProperty(I2PClient.PROP_USER, configUser);
+                options.setProperty(I2PClient.PROP_PW, configPW);
             }
         }
         if (options.getProperty(I2PClient.PROP_FAST_RECEIVE) == null)
@@ -748,7 +743,7 @@ public abstract class I2PSessionImpl implements I2PSession, I2CPMessageReader.I2
                         } catch (InvocationTargetException e) {
                             throw new I2PSessionException("Cannot load DomainSocketFactory", e);
                         }
-                    } else if (Boolean.parseBoolean(_options.getProperty(PROP_ENABLE_SSL))) {
+                    } else if (Boolean.parseBoolean(_options.getProperty(I2PClient.PROP_ENABLE_SSL))) {
                         try {
                             I2PSSLSocketFactory fact = new I2PSSLSocketFactory(_context, false, "certificates/i2cp");
                             _socket = fact.createSocket(_hostname, _portNum);
@@ -776,12 +771,12 @@ public abstract class I2PSessionImpl implements I2PSession, I2CPMessageReader.I2
             _reader.startReading();
             if (_log.shouldLog(Log.DEBUG)) _log.debug(getPrefix() + "Before getDate");
             Properties auth = null;
-            if ((!_context.isRouterContext()) && _options.containsKey(PROP_USER) && _options.containsKey(PROP_PW)) {
+            if ((!_context.isRouterContext()) && _options.containsKey(I2PClient.PROP_USER) && _options.containsKey(I2PClient.PROP_PW)) {
                 // Only supported by routers 0.9.11 or higher, but we don't know the version yet.	
                 // Auth will also be sent in the SessionConfig.
                 auth = new OrderedProperties();
-                auth.setProperty(PROP_USER, _options.getProperty(PROP_USER));
-                auth.setProperty(PROP_PW, _options.getProperty(PROP_PW));
+                auth.setProperty(I2PClient.PROP_USER, _options.getProperty(I2PClient.PROP_USER));
+                auth.setProperty(I2PClient.PROP_PW, _options.getProperty(I2PClient.PROP_PW));
             }
             sendMessage_unchecked(new GetDateMessage(CoreVersion.VERSION, auth));
             waitForDate();
diff --git a/core/java/src/net/i2p/client/impl/I2PSimpleSession.java b/core/java/src/net/i2p/client/impl/I2PSimpleSession.java
index c7fe6a84efb036fbad5b0575dbf11b314d9a18f2..f7a9ca157e49154422dd1f22e99cba4e9be0f688 100644
--- a/core/java/src/net/i2p/client/impl/I2PSimpleSession.java
+++ b/core/java/src/net/i2p/client/impl/I2PSimpleSession.java
@@ -80,7 +80,7 @@ public class I2PSimpleSession extends I2PSessionImpl2 {
                     _reader = new QueuedI2CPMessageReader(_queue, this);
                     _reader.startReading();
                 } else {
-                    if (Boolean.parseBoolean(getOptions().getProperty(PROP_ENABLE_SSL))) {
+                    if (Boolean.parseBoolean(getOptions().getProperty(I2PClient.PROP_ENABLE_SSL))) {
                         try {
                             I2PSSLSocketFactory fact = new I2PSSLSocketFactory(_context, false, "certificates/i2cp");
                             _socket = fact.createSocket(_hostname, _portNum);
@@ -110,19 +110,19 @@ public class I2PSimpleSession extends I2PSessionImpl2 {
                 // Auth was not enforced on a simple session until 0.9.11
                 // We will get disconnected for router version < 0.9.11 since it doesn't
                 // support the AuthMessage
-                if ((!opts.containsKey(PROP_USER)) && (!opts.containsKey(PROP_PW))) {
+                if ((!opts.containsKey(I2PClient.PROP_USER)) && (!opts.containsKey(I2PClient.PROP_PW))) {
                     // auto-add auth if not set in the options
-                    String configUser = _context.getProperty(PROP_USER);
-                    String configPW = _context.getProperty(PROP_PW);
+                    String configUser = _context.getProperty(I2PClient.PROP_USER);
+                    String configPW = _context.getProperty(I2PClient.PROP_PW);
                     if (configUser != null && configPW != null) {
-                        opts.setProperty(PROP_USER, configUser);
-                        opts.setProperty(PROP_PW, configPW);
+                        opts.setProperty(I2PClient.PROP_USER, configUser);
+                        opts.setProperty(I2PClient.PROP_PW, configPW);
                     }
                 }
-                if (opts.containsKey(PROP_USER) && opts.containsKey(PROP_PW)) {
+                if (opts.containsKey(I2PClient.PROP_USER) && opts.containsKey(I2PClient.PROP_PW)) {
                     Properties auth = new OrderedProperties();
-                    auth.setProperty(PROP_USER, opts.getProperty(PROP_USER));
-                    auth.setProperty(PROP_PW, opts.getProperty(PROP_PW));
+                    auth.setProperty(I2PClient.PROP_USER, opts.getProperty(I2PClient.PROP_USER));
+                    auth.setProperty(I2PClient.PROP_PW, opts.getProperty(I2PClient.PROP_PW));
                     sendMessage_unchecked(new GetDateMessage(CoreVersion.VERSION, auth));
                 } else {
                     // we must now send a GetDate even in SimpleSession, or we won't know
diff --git a/core/java/src/net/i2p/client/naming/LookupDest.java b/core/java/src/net/i2p/client/naming/LookupDest.java
index ae91e8b6a1593783589a5dbb4c6a3a49de3ff65c..dee20b7be8a33ebe9b0d1bf334c4889029172050 100644
--- a/core/java/src/net/i2p/client/naming/LookupDest.java
+++ b/core/java/src/net/i2p/client/naming/LookupDest.java
@@ -34,9 +34,6 @@ import net.i2p.data.Hash;
 class LookupDest {
 
     private static final long DEFAULT_TIMEOUT = 15*1000;
-    private static final String PROP_ENABLE_SSL = "i2cp.SSL";
-    private static final String PROP_USER = "i2cp.username";
-    private static final String PROP_PW = "i2cp.password";
 
     protected LookupDest(I2PAppContext context) {}
 
@@ -110,15 +107,15 @@ class LookupDest {
             s = ctx.getProperty(I2PClient.PROP_TCP_PORT);
             if (s != null)
                 opts.put(I2PClient.PROP_TCP_PORT, s);
-            s = ctx.getProperty(PROP_ENABLE_SSL);
+            s = ctx.getProperty(I2PClient.PROP_ENABLE_SSL);
             if (s != null)
-                opts.put(PROP_ENABLE_SSL, s);
-            s = ctx.getProperty(PROP_USER);
+                opts.put(I2PClient.PROP_ENABLE_SSL, s);
+            s = ctx.getProperty(I2PClient.PROP_USER);
             if (s != null)
-                opts.put(PROP_USER, s);
-            s = ctx.getProperty(PROP_PW);
+                opts.put(I2PClient.PROP_USER, s);
+            s = ctx.getProperty(I2PClient.PROP_PW);
             if (s != null)
-                opts.put(PROP_PW, s);
+                opts.put(I2PClient.PROP_PW, s);
         }
         return opts;
     }
diff --git a/router/java/src/net/i2p/router/client/ClientMessageEventListener.java b/router/java/src/net/i2p/router/client/ClientMessageEventListener.java
index 4896b83f62e68122387044423f84aeaf9b7189d6..150773a4bdd3ef12091ee1f6020e8d1034dcf3b9 100644
--- a/router/java/src/net/i2p/router/client/ClientMessageEventListener.java
+++ b/router/java/src/net/i2p/router/client/ClientMessageEventListener.java
@@ -12,6 +12,7 @@ import java.util.List;
 import java.util.Properties;
 
 import net.i2p.CoreVersion;
+import net.i2p.client.I2PClient;
 import net.i2p.crypto.EncType;
 import net.i2p.crypto.SigType;
 import net.i2p.data.Base64;
@@ -384,8 +385,8 @@ class ClientMessageEventListener implements I2CPMessageReader.I2CPMessageEventLi
             String user = null;
             String pw = null;
             if (props != null) {
-                user = props.getProperty("i2cp.username");
-                pw = props.getProperty("i2cp.password");
+                user = props.getProperty(I2PClient.PROP_USER);
+                pw = props.getProperty(I2PClient.PROP_PW);
             }
             if (user == null || user.length() == 0 || pw == null || pw.length() == 0) {
                 _log.logAlways(Log.WARN, "I2CP authentication failed");
diff --git a/router/java/src/net/i2p/router/util/RouterPasswordManager.java b/router/java/src/net/i2p/router/util/RouterPasswordManager.java
index 3c2fb9b7d687cb5ff81c0f64d929fe7555147bbd..3f5bbc98d6ea4238cd5c3bd42416840c59b894c5 100644
--- a/router/java/src/net/i2p/router/util/RouterPasswordManager.java
+++ b/router/java/src/net/i2p/router/util/RouterPasswordManager.java
@@ -6,6 +6,7 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
+import net.i2p.client.I2PClient;
 import net.i2p.data.Base64;
 import net.i2p.data.DataHelper;
 import net.i2p.data.SessionKey;
@@ -23,8 +24,8 @@ public class RouterPasswordManager extends PasswordManager {
 
     private static final String PROP_MIGRATED = "router.passwordManager.migrated";
     // migrate these to hash
-    private static final String PROP_I2CP_OLD_PW = "i2cp.password";
-    private static final String PROP_I2CP_OLD_USER = "i2cp.username";
+    private static final String PROP_I2CP_OLD_PW = I2PClient.PROP_PW;
+    private static final String PROP_I2CP_OLD_USER = I2PClient.PROP_USER;
     private static final String PROP_I2CP_NEW = "i2cp.auth";
 /****
     // migrate these to b64