openssl-passwd

openssl passwd [-help] [-1] [-apr1] [-aixmd5] [-5] [-6] [-salt string] [-in file] [-stdin] [-noverify] [-quiet] [-table] [-reverse] [password]

openssl passwd computes a one-way hash of a password using a Unix crypt-style algorithm. Passwords come from a command-line argument, a file (-in), standard input (-stdin), or an interactive terminal prompt.The default algorithm is MD5 crypt (-1). -5 and -6 select SHA-256 and SHA-512 crypt. -apr1 produces hashes compatible with Apache htpasswd MD5 files. Unless -salt is given, a new random salt is used, so the same password hashes to a different string each run.Typical uses include generating `/etc/shadow`-style hashes for provisioning, Apache apr1 hashes, and checking how a given password encodes under a chosen algorithm. This command only prints hashes; it does not change system accounts.

-help

Print a usage message and exit.

Use the MD5-based BSD password algorithm (`$1$`). This is the default.

Use Apache's apr1 variant of the BSD MD5 algorithm (`$apr1$`).

Use the AIX MD5 variant of the BSD algorithm.

Use SHA-256 crypt as specified by Ulrich Drepper (`$5$`).

Use SHA-512 crypt as specified by Ulrich Drepper (`$6$`).

Use this salt instead of a random one. When the password is read from the terminal, this also implies -noverify.

Read passwords from file, one per line.

Read passwords from standard input.

Do not prompt a second time when reading a password from the terminal.

Suppress warnings that a command-line password was truncated.

Prepend the cleartext password and a tab character to each hash.

With -table, print hash then cleartext instead of cleartext then hash.

Password to hash. If omitted, and neither -in nor -stdin is given, the password is read from the terminal.

A password on the command line is visible in the process list. Prefer a terminal prompt or -stdin. The default -1 (MD5 crypt) is weak by modern standards; use -6 (SHA-512 crypt) unless you need a specific legacy format.Without -salt, output changes on every invocation. Traditional DES crypt (`-crypt`), which truncated passwords to 8 characters, was removed in OpenSSL 3.0. Hashes from this command are not bcrypt, scrypt, or Argon2.

openssl passwd has been part of the OpenSSL command-line tools since around 2000. In OpenSSL 1.1.x the default algorithm was traditional Unix crypt, selected with -crypt. OpenSSL 3.0 (2021) removed -crypt; the default became -1 (MD5 crypt). -5 and -6 implement Drepper's SHA-crypt.

openssl(1), htpasswd(1), mkpasswd(1), passwd(1)

Source code · Homepage · Documentation