---
name: "slappasswd"
section: "8"
platform: "linux"
package: "openldap"
version: "2.7.2-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/slappasswd"
---

# slappasswd(8)

OpenLDAP password utility

## NAME

slappasswd - OpenLDAP password utility

## SYNOPSIS

**/usr/bin/slappasswd** \[**-v**\] \[**-u**\] \[**-g**\|**-s** *secret***\|****-T** ***file*\]** \[**-h** *hash\]* \[**-c** *salt-format\]* \[**-n**\] \[**-o** *option\[***=***value\]\]*

## DESCRIPTION

**Slappasswd** is used to generate an userPassword value suitable for use with [**ldapmodify**(1)](/ldapmodify/1.md), [**slapd.conf**(5)](/slapd.conf/5.md) *rootpw* configuration directive or the  [**slapd-config**(5)](/slapd-config/5.md) *olcRootPW* configuration directive.

## OPTIONS

- **-v**

  enable verbose mode.

- **-u**

  Generate RFC 2307 userPassword values (the default).  Future versions of this program may generate alternative syntaxes by default.  This option is provided for forward compatibility.

- **-s** *secret*

  The secret to hash. If this, **-g** and **-T** are absent, the user will be prompted for the secret to hash. **-s**, **-g** and **-T** are mutually exclusive flags.

- **-g**

  Generate the secret. If this, **-s** and **-T** are absent, the user will be prompted for the secret to hash. **-s**, **-g** and **-T** are mutually exclusive flags. If this is present, *{CLEARTEXT}* is used as scheme. **-g** and **-h** are mutually exclusive flags.

- **-T** *"file"*

  Hash the contents of the file. If this, **-g** and **-s** are absent, the user will be prompted for the secret to hash. **-s**, **-g** and **-T** and mutually exclusive flags.

- **-h** *"scheme"*

  If **-h** is specified, one of the following RFC 2307 schemes may be specified: **{CRYPT}**, **{MD5}**, **{SMD5}**, **{SSHA}**, and **{SHA}**. The default is  **{SSHA}**.

  Note that scheme names may need to be protected, due to **{** and **}**, from expansion by the user's command interpreter.

  **{SHA}** and **{SSHA}** use the SHA-1 algorithm (FIPS 160-1), the latter with a seed.

  **{MD5}** and **{SMD5}** use the MD5 algorithm (RFC 1321), the latter with a seed.

  **{CRYPT}** uses the [**crypt**(3)](/crypt/3.md).

  **{CLEARTEXT}** indicates that the new password should be added to userPassword as clear text. Unless *{CLEARTEXT}* is used, this flag is incompatible with option **-g**.

- **-c** *crypt-salt-format*

  Specify the format of the salt passed to [**crypt**(3)](/crypt/3.md) when generating {CRYPT} passwords.   This string needs to be in [**sprintf**(3)](/sprintf/3.md) format and may include one (and only one) **%s** conversion. This conversion will be substituted with a string of random characters from \[A-Za-z0-9./\].  For example, '**%.2s**' provides a two character salt and '**$1$%.8s**' tells some versions of [**crypt**(3)](/crypt/3.md) to use an MD5 algorithm and provides 8 random characters of salt. The default is '**%s**'**,** which provides 31 characters of salt.

- **-n**

  Omit the trailing newline; useful to pipe the credentials into a command.

- **-o** *option\[***=***value\]*

  Specify an *option* with a(n optional) *value*. Possible generic options/values are:

```
              module-path=<pathspec> (see `modulepath' in slapd.conf(5))
              module-load="<filename> [<arguments>...]" (see `moduleload' in slapd.conf(5))
You can load a dynamically loadable password hash module by
using this option.
```

## LIMITATIONS

The practice of storing hashed passwords in userPassword violates Standard Track (RFC 4519) schema specifications and may hinder interoperability.  A new attribute type, authPassword, to hold hashed passwords has been defined (RFC 3112), but is not yet implemented in [**slapd**(8)](/slapd/8.md).

It should also be noted that the behavior of [**crypt**(3)](/crypt/3.md) is platform specific.

## SECURITY CONSIDERATIONS

Use of hashed passwords does not protect passwords during protocol transfer.  TLS or other eavesdropping protections should be in-place before using LDAP simple bind.

The hashed password values should be protected as if they were clear text passwords.

## SEE ALSO

[**ldappasswd**(1)](/ldappasswd/1.md), [**ldapmodify**(1)](/ldapmodify/1.md), [**slapd**(8)](/slapd/8.md), [**slapd.conf**(5)](/slapd.conf/5.md), [**slapd-config**(5)](/slapd-config/5.md), **RFC 2307,** **RFC 4519,** **RFC 3112**

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS

**OpenLDAP Software** is developed and maintained by The OpenLDAP Project \<http://www.openldap.org/\>. **OpenLDAP Software** is derived from the University of Michigan LDAP 3.3 Release.