Generate Password Hashes with openssl passwd

You need a crypt-style hash for a config file or migration script, and openssl passwd makes one without touching your shell history.

The examples use OpenSSL 3.6.1, installed on this machine, with the openssl-passwd(1ssl) manpage dated 18 August 2026 and labelled 3.0.13.

Allow about ten minutes. You need OpenSSL and a shell. No elevated privileges are required, and this guide does not edit account files, web-server configuration or any service. The command computes hashes; it does not check whether a supplied hash matches a password.

1. Check the installed command

Confirm the expected executable is first in your path and record its version. These are ordinary read-only commands:

$ command -v openssl
/home/linuxbrew/.linuxbrew/bin/openssl
$ openssl version
OpenSSL 3.6.1 27 Jan 2026

Read the local option summary when working on a different installation:

$ openssl passwd -help
Usage: passwd [options] [password]

Input options:
 -in infile          Read passwords from file
 -stdin              Read passwords from stdin

Output options:
 -table              Format output as table
 -reverse            Switch table columns

The subcommand is named passwd, even though its manual page is openssl-passwd(1ssl). A password argument is optional; when it is omitted, OpenSSL reads from the terminal.

2. Generate one hash without putting the password in history

For a real secret, omit the password argument and let OpenSSL prompt. Choose the algorithm explicitly. SHA-512 crypt is selected with -6:

$ openssl passwd -6
Password:
Verifying - Password:
$6$RANDOM_SALT$GENERATED_HASH

The salt and hash above are placeholders showing the shape of the result. Your output will differ. The password is not displayed while you type it. The second prompt verifies the entry; if the two entries differ, start again with the correct password.

3. Select the format deliberately

• -6 selects SHA-512 crypt.
• -5 selects SHA-256 crypt.
• -1 is the default and uses the MD5-based BSD password algorithm.
• -apr1 selects Apache's variant.
• -aixmd5 selects the AIX variant.

Use a fixed salt only for a test or a compatibility check. This command makes the result reproducible:

$ openssl passwd -6 -salt xxxxxxxx password
$6$xxxxxxxx$wqnb6MLqmjMU5Hx4wQ0qsgf/VWMnStSJlbRMy5buT2fPUnVASxaE4zm2JBuj6ISxoGFOWhZODdzl2VyW/Ltzz.

This example deliberately uses the literal test password password, so do not copy it into a real account or application. A fixed salt also means the same password produces the same result, which is useful for checking a migration but undesirable as a general practice. For normal use, omit -salt and let the command generate one.

4. Test safely with standard input

If another program must supply a test value, use -stdin rather than putting the value in the command's positional argument. Standard input is still sensitive, so do not use this pattern with a real password in shell history or a logged pipeline:

$ printf '%s\n' 'password' | openssl passwd -6 -salt xxxxxxxx -stdin
$6$xxxxxxxx$wqnb6MLqmjMU5Hx4wQ0qsgf/VWMnStSJlbRMy5buT2fPUnVASxaE4zm2JBuj6ISxoGFOWhZODdzl2VyW/Ltzz.

That exact output verifies the local command accepts the expected input path. For an interactive operator workflow, the terminal prompt from step 2 is safer because the secret is not written in the command line. For an application, use its supported password-hashing library and keep the secret inside that application's controlled input path rather than constructing shell commands.

5. Hash a password list

Use -in when each line of a file is a separate password. This changes the handling of every line, so inspect the input file and its permissions before running it. The command itself is ordinary, but the file may contain secrets:

$ openssl passwd -6 -in password-list.txt
$6$generated-salt-1$generated-hash-1
$6$generated-salt-2$generated-hash-2

Output order follows input order. The displayed salts and hashes are illustrative. If the input file is temporary, remove it using your normal approved secure-handling process once you have confirmed no job, shell history entry or log still needs it. Do not paste real passwords into a guide, ticket or terminal recording.

6. Preserve or hide the cleartext in output

-table prefixes each hash with the cleartext password and a TAB. Convenient for a controlled migration test, dangerous in logs, copied output and shared terminals:

$ printf '%s\n' 'password' | openssl passwd -6 -salt xxxxxxxx -stdin -table
password    $6$xxxxxxxx$wqnb6MLqmjMU5Hx4wQ0qsgf/VWMnStSJlbRMy5buT2fPUnVASxaE4zm2JBuj6ISxoGFOWhZODdzl2VyW/Ltzz.

-reverse changes that table order to hash first and cleartext second. It does not hide the password:

$ printf '%s\n' 'password' | openssl passwd -6 -salt xxxxxxxx -stdin -table -reverse
$6$xxxxxxxx$wqnb6MLqmjMU5Hx4wQ0qsgf/VWMnStSJlbRMy5buT2fPUnVASxaE4zm2JBuj6ISxoGFOWhZODdzl2VyW/Ltzz.    password

Common traps

• Trusting -quiet as a safety net. A password supplied directly as the final command-line argument can be exposed through shell history or process inspection. OpenSSL may warn when such passwords are truncated; -quiet suppresses those warnings, but it does not make command-line passwords safe or prevent truncation.
• Forgetting a fixed salt skips the second prompt. The manpage records that specifying -salt implies -noverify for terminal input, so a fixed-salt prompt does not ask for a second copy of the password. Use a fixed salt only when reproducing a known test or compatibility result.
• Assuming -crypt still works. That old option was removed in OpenSSL 3.0. If a script still passes it, update the script for the format its target system actually requires and test the import before changing production data. Do not silently replace it with -1 or -6; those formats are not interchangeable.