PWHASH(1) | General Commands Manual | PWHASH(1)

# NAME

`pwhash` — hashes passwords from the command line or standard input

# SYNOPSIS

`pwhash` | [`-km`] [`-A` variant[,params]] [`-b` rounds] [`-S` rounds] [`-s` salt] [`-p` | string]

# DESCRIPTION

`pwhash` prints the encrypted form of string to the standard output. This is mostly useful for encrypting passwords from within scripts.

The options are as follows:

`-b` rounds
  Encrypt the string using Blowfish hashing with the specified rounds.
`-k`
  Run in makekey(8) compatible mode. A single combined key (eight chars) and salt (two chars) with no intermediate space are read from standard input and the DES encrypted result is written to standard output without a terminating newline.
`-m`
  Hash the string using MD5.
`-p`
  Prompt for a single string with echo turned off.
`-S` rounds
  Encrypt the salt with HMAC-SHA1 using the password as key and the specified rounds as a hint for the number of iterations.
`-A` variant[,params]
  Encrypt the specified string using Argon2 hashing parameterized using variant variant, where variant is one of the following: argon2id, argon2i, argon2d. Variant argon2id is recommended.

  Following the required variant name, three optional comma-delimited parameters may be provided,

  t=n Specify the number of iterations to n.

  m=n Specify the memory usage in KB to n.

  p=n Specify the number of threads to n. This is currently ignored.

  If unspecified, default parameters are calculated based on system performance and available resources.

`-s` salt
  Encrypt the string using DES, with the specified salt.

If no string is specified, `pwhash` reads one string per line from standard input, encrypting each one with the chosen algorithm from above. In the event that no specific algorithm is given as a command line option, the algorithm specified in the default class in /etc/passwd.conf will be used.

For MD5, Blowfish, and Argon2 a new random salt is automatically generated for each password.

Specifying the string on the command line should be discouraged; using the standard input is more secure.

# EXAMPLES

The following specifies the argon2id variant, using 1 thread and 4096KB of memory

pwhash -A argon2id,p=1,m=4096 -p

# FILES

/etc/passwd.conf

# SEE ALSO

crypt(3), passwd.conf(5)

October 20, 2021 | NetBSD 11.0