There is a well-known unix utility called mkpasswd available on many *nix systems.

I was just trying to use it from terminal on an OSX 10.10.5 Yosemite (Early 2015) machine, and it is nowhere to be found.

How can I install it on this machine? or is there an alternative already available?

  • And FWIW, there is an interesting online password generator I've found which lacks options, but looks useful all the same!
    – Dɑvïd
    Commented Jul 11, 2017 at 15:16

10 Answers 10


There's a Mac implementation of mkpasswd on GitHub - https://github.com/PrototypeAlex/mkpasswd

Alternatively, Keychain Access has a built-in GUI password generator
File menu > New Password Item... > [click the key icon]

drop-menu artificially offset for visibility

enter image description here

I also found this Apple Discussion on how to achieve it natively, though it's unfortunately above my skill-level, so I'll let you see if you think it might be suitable.

  • Thanks - the "Mac implementation" is a ruby script requiring "gems" -- any idea what it's relationship is to the unix mkpasswd.c utility? Helpful Apple Discussion thread: my main take-away is that you can use $ slappasswd -g from the command line natively in OSX to generate an 8-character mixed case + digits password, but no way to tailor output (e.g. string length) that I can see, like there is with the Keychain Access helper.
    – Dɑvïd
    Commented Jun 20, 2016 at 8:44
  • Sorry, idk what the relationship may be - I'm afraid my skill-set is very much GUI-based, so I always rely on the Keychain version.
    – Tetsujin
    Commented Jun 20, 2016 at 8:53
  • 2
    github.com/PrototypeAlex/mkpasswd is dead
    – evandrix
    Commented Mar 6, 2020 at 18:08
  • yes this answer is a bit outdated. check my answer below with golang multi platform implementation. apple.stackexchange.com/a/407318/68672
    – seven
    Commented Nov 25, 2020 at 22:25
  • @David, you could do something like for i in {0..$(($n/8))}; do slappasswd -g; done | tr '\n' '' | head -c $n, where $n is the desired password length. Stick that in a script in your $PATH called mkpasswd with n=$1, and then you can do e.g. mkpasswd 22 to get a 22-character password.
    – Jivan Pal
    Commented Nov 26, 2020 at 1:12

Coming from the docker world, on your Mac/Windows/Linux box (with docker installed):

docker run -it --rm alpine mkpasswd -m des helloworld

Replace your mkpasswd arguments as needed.

  • 1
    absolutely great idea. My example: docker run -it --rm alpine sh -c 'printf "P@$$w0rD" | mkpasswd -s -m md5'
    – Michael A.
    Commented Oct 1, 2020 at 8:27

I made a tool for creating mkpasswd -m sha-512 (Linux/Ubuntu) style hashes on OS X (or any platform).

First, we need to acquire a single requirement...

pip3 install passlib

Now we create mkpasswd_sha-512.py (or whatever you want to call it)...

#!/usr/bin/env python3

# based on https://stackoverflow.com/a/17992126/117471

import sys
from getpass import getpass
from passlib.hash import sha512_crypt

passwd = input() if not sys.stdin.isatty() else getpass()

It only handles a single use case of mkpasswd but if it fits, enjoy.

Note: There is a slightly more complicated version at https://gist.github.com/RichardBronosky/58f1b34d2bcf4c4e5f1cd18a88fdc37d which simplifies tuning the CPU Cost, but passlib manages that periodically for you so it's fine to keep it simple like this.

  • 1
    Great answer, this works perfectly for me after I ran pip3 install passlib Commented Sep 21, 2018 at 14:13
  • @WillSheppard thank you! I added that detail to the answer. Commented Sep 21, 2018 at 14:34

Here's the source code for mkpasswd. It's an expect script. You would have to modify the script (at least the shebang) in order for it to work. There are other command line tools such as openssl (md5), jot and dd that can generate passwords.

  • 2
    pwgen is also useful and has similar options to mkpasswd for phonetic/memorable passwords . I was not familiar with mkpasswd and found this comparison: cyberciti.biz/faq/generating-random-password
    – Freiheit
    Commented Jun 20, 2016 at 14:21
  • jot is a new one for me (from BSD?) and included with OSX. There's a nice forum post giving examples of its use for password generation.
    – Dɑvïd
    Commented Jun 20, 2016 at 15:32

With openssl

In macOS, it's very simple, using openssl which is a native already installed package (as mentioned in the apple article shared in @Tetsujin’s answer):

I'm going here to explain how to use in details:

openssl passwd -6
  • 6 stands for SHA-512

To show what crypto hashes are supported:

openssl passed -help
  • Check Cryptographic options:
Input options:
 -in infile          Read passwords from file
 -noverify           Never verify when reading password from terminal
 -stdin              Read passwords from stdin

Output options:
 -quiet              No warnings
 -table              Format output as table
 -reverse            Switch table columns

Cryptographic options:
 -salt val           Use provided salt
 -6                  SHA512-based password algorithm
 -5                  SHA256-based password algorithm
 -apr1               MD5-based password algorithm, Apache variant
 -1                  MD5-based password algorithm
 -aixmd5             AIX MD5-based password algorithm

Random state options:
 -rand val           Load the given file(s) into the random number generator
 -writerand outfile  Write random data to the specified file

Provider options:
 -provider-path val  Provider load path (must be before 'provider' argument if required)
 -provider val       Provider to load (can be specified multiple times)
 -propquery val      Property query used when fetching algorithms

Using python




python3 -c "from passlib.hash import sha512_crypt; import getpass; swd = getpass.getpass('Password:'); print(sha512_crypt.hash(swd))"

output format

  • Note that the output from this differs from the one of OpenSSL. It should work in things like ansible, and I suppose other usages. Because if the OS supports crypt() then passlib will use that sys call. There is a round param and others, check the reference above.


  • Install the passlib library:
pip3 install --user passlib 

slappasswd no SHA512

man slappasswd

-h "scheme"
       If -h is specified, one of the following RFC 2307 schemes may be specified: {CRYPT}, {MD5}, {SMD5}, {SSHA},
       and {SHA}.  The default is {SSHA}.

       Note that scheme names may need to be protected, due to { and }, from expansion by the user's command

       {SHA} and {SSHA} use the SHA-1 algorithm (FIPS 160-1), the latter with a seed.

       {MD5} and {SMD5} use the MD5 algorithm (RFC 1321), the latter with a seed.

       {CRYPT} uses the crypt(3).

       {CLEARTEXT} indicates that the new password should be added to userPassword as clear text.  Unless
       {CLEARTEXT} is used, this flag is incompatible with option -g.
  • 3
    Please don't post images of text. It is not searchable and is inaccessible to those with visual disabilities. Please edit your answer to include actual text.
    – agarza
    Commented Sep 18, 2023 at 0:20
  • 1
    Please note the following Meta post: Why should I not upload images of code/data/errors?.
    – agarza
    Commented Sep 18, 2023 at 13:58
  • 1
    This answer is the best answer, even if they are using photos. This is a native way to get the mkpasswd output, from a bulit-in mac binary.
    – ZaxLofful
    Commented Sep 19, 2023 at 7:07
  • 2
    I've removed the screenshots as they didn't add any value in addition to the answer provided. Also, for visually impaired users it's still confusing because they have no way to understand that they don't miss out on anything in the pictures. There is no need to show that it works within the answer, users here assume that you tested your code anyway before posting :-)
    – nohillside
    Commented Sep 19, 2023 at 10:59
  • 1
    There is no Python 2 on macOS anyway, so the risk of getting this wrong is rather small. Actually, there isn't even a python binary, it's called python3 (and pip3).
    – nohillside
    Commented Sep 19, 2023 at 11:59

Here is a simple mkpasswd utility written in golang for platform portability.

mkpasswd -h

Usage of mkpasswd:
  -hash string
        Optional hash argument: sha512, sha256, md5 or apr1 (default "sha512")
  -password string
        Optional password argument
  -rounds int
        Optional number of rounds
  -salt string
        Optional salt argument without prefix

I successfully installed mkpasswd on my macOS Catalina (10.15.2) using sudo gem install mkpasswd

  • /usr/local/lib/ruby/gems/2.7.0/gems/unix-crypt-1.3.0/lib/unix_crypt/base.rb:5:in `build': Salts longer than 2 characters are not permitted (UnixCrypt::SaltTooLongError)
    – evandrix
    Commented Mar 6, 2020 at 18:28

If you actually want the original mkpasswd utility, just install expect using Homebrew:

brew install expect

However, the original mkpasswd does not include the capability to hash a password using SHA-512 mentioned elsewhere on this page.

Another way to get that is to install the Perl CPAN distributions App::bmkpasswd (providing bmkpasswd) and Crypt::Passwd::XS (providing SHA support).

You can then run:

bmkpasswd --method='sha512' <password>

on the command line to hash a password (specified in place of <password>) using SHA-512.


You can use ruby and securerandom library for password generation:

function random-password() {
  local length="${1:-24}"
  ruby -r securerandom -e "puts SecureRandom.base64($length)" | tr -d "[:punct:]" 2> /dev/null

alias mkpasswd=random-password

Check out my dotfile


I successfully installed mkpasswd on my macOS 10.14.5 using gem install mkpasswd.

gem install mkpasswd
Fetching mkpasswd-0.1.0.gem
Fetching unix-crypt-1.3.0.gem
Successfully installed unix-crypt-1.3.0
Successfully installed mkpasswd-0.1.0
Parsing documentation for unix-crypt-1.3.0
Installing ri documentation for unix-crypt-1.3.0
Parsing documentation for mkpasswd-0.1.0
Installing ri documentation for mkpasswd-0.1.0
Done installing documentation for unix-crypt, mkpasswd after 0 seconds
2 gems installed

Here is where I get this information.

  • /usr/local/lib/ruby/gems/2.7.0/gems/unix-crypt-1.3.0/lib/unix_crypt/base.rb:5:in `build': Salts longer than 2 characters are not permitted (UnixCrypt::SaltTooLongError)
    – evandrix
    Commented Mar 6, 2020 at 18:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .