PWHASH(1) | General Commands Manual | PWHASH(1)

# NAME

`pwhash` —
hashes passwords from the command line or standard input

# SYNOPSIS

`pwhash` | [`-km`] [`-b` rounds] [`-S` rounds] [`-s` salt] [`-p` | string]

# DESCRIPTION

`pwhash` prints the encrypted form of string to the standard output. This is mostly useful for encrypting passwords from within scripts.

The options are as follows:

`-b` rounds
  Encrypt the string using Blowfish hashing with the specified rounds.
`-k`
  Run in makekey(8) compatible mode. A single combined key (eight chars) and salt (two chars) with no intermediate space are read from standard input and the DES encrypted result is written to standard output without a terminating newline.
`-m`
  Hash the string using MD5.
`-p`
  Prompt for a single string with echo turned off.
`-S` rounds
  Encrypt the salt with HMAC-SHA1 using the password as key and the specified rounds as a hint for the number of iterations.
`-s` salt
  Encrypt the string using DES, with the specified salt.

If no string is specified, `pwhash` reads one string per line from standard input, encrypting each one with the chosen algorithm from above. In the event that no specific algorithm is given as a command line option, the algorithm specified in the default class in /etc/passwd.conf will be used.

For MD5 and Blowfish a new random salt is automatically generated for each password.

Specifying the string on the command line should be discouraged; using the standard input is more secure.

# FILES

/etc/passwd.conf

# SEE ALSO

crypt(3), passwd.conf(5)

May 24, 2016 | NetBSD 9.4