DOVEADM-PW(1)

💖 DOVEADM-PW — the Dovecot password hash glow-up station 💖

okay bestie, so this is doveadm-pw, the Dovecot password hash generator and validator, straight out of the Dovecot manual (section 1, the user commands one, iykyk). It makes hashes, and it can check hashes. That's the whole vibe. ✨

---

✨ SYNOPSIS ✨

doveadm [GLOBAL OPTIONS] pw -l

doveadm [GLOBAL OPTIONS] pw [-p password] [-r rounds] [-s scheme] [-u
user] [-V]

doveadm [GLOBAL OPTIONS] pw -t hash [-p password] [-u user]

---

🌸 DESCRIPTION 🌸

doveadm pw is your girl for generating password hashes in all the different password schemes, and optionally verifying the hash you just made. Bestie behaviour, fr fr.

Every generated password hash comes with a {scheme} prefix, like {SHA512-CRYPT.HEX}. Meanwhile all passdbs have a default scheme they use for passwords that were stored without a {scheme} prefix. And plot twist: you can override that default scheme just by storing the password with the scheme prefix. 💅

Now, if you wanna verify or generate passwords without configuring Dovecot first — no setup, no drama — you can just run doveadm -O pw. iconic. 👑

---

🌈 GLOBAL OPTIONS 🌈

The global doveadm(1) options, bestie:

• -D — turns on verbosity and debug messages. maximum oversharing, love that for us.
• -O — don't read any config file at all, just use defaults. the dovecot_storage_version setting defaults to the latest version, but you can override it with -o.
• -k — preserves the entire environment for doveadm, not just the import_environment setting.
• -v — verbosity on, including a progress counter. we love a lil progress moment.
• -i instance-name — if you're running multiple Dovecot instances, pick the config file based on this instance name. see the instance_name setting for more.
• -c config-file — read configuration from the given config-file. by default it first reads the config socket, then falls back to /etc/dovecot/dovecot.conf. you can also point this at the config socket of some instance running a compatible version.
• -o setting=value — overrides the configuration setting from /etc/dovecot/dovecot.conf and from the userdb with the given value. wanna override multiple settings? just use -o multiple times, it's fine.

---

💅 OPTIONS 💅

• -l — lists all supported password schemes and exits successfully. 🎉

quick heads up: there are up to three optional password schemes — BLF-CRYPT (Blowfish crypt), SHA256-CRYPT and SHA512-CRYPT. whether they're available depends on the system's currently used libc. so like, it depends on your libc's mood, basically. 💀

• -p password — the plain text password you want the hash generated for. if you don't give a password, doveadm(1) will prompt you interactively for one. (⚠️ beware: using this option means your plain text password ends up in your shell history! not the slay you think it is.)
• -r rounds — the password schemes BLF-CRYPT, SHA256-CRYPT and SHA512-CRYPT support a variable number of encryption rounds. here's the minimum/maximum number of encryption rounds per scheme, and if you omit the -r option, the default number of encryption rounds gets applied:
  • BLF-CRYPT — minimum 4, maximum 31, default 5
  • SHA256-CRYPT — minimum 1000, maximum 999999999, default 5000
  • SHA512-CRYPT — minimum 1000, maximum 999999999, default 5000
• -s scheme — the password scheme that should be used to generate the hashed password. by default the CRYPT scheme is used (with the $2y$ bcrypt format). you can also append an encoding suffix to the scheme — the supported encoding suffixes are: .b64, .base64 and .hex. ✨

see also password_schemes for more details about password schemes.

• -t hash — test whether the given password hash matches a given plain text password. you should enclose the password hash in single quotes if it contains one or more dollar signs ($). the plain text password can be passed with the -p option. when no password was specified, doveadm(1) will prompt you interactively for one.
• -u user — when the DIGEST-MD5 scheme is used, the user name must also be given, because the user name is literally part of the generated hash. for more info about Digest-MD5, also read auth_digest_md5. for other schemes, this isn't required. 🫶
• -V — when this option is given, the hashed password gets internally verified. the result of the verification shows up after the hashed password, enclosed in parentheses.

---

🎀 EXAMPLE 🎀

An ARGON2ID hash — best security at time of this writing, though it can be heavy on a busy server:

# doveadm pw -s ARGON2ID
Enter new password:
Retype new password:
{ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$AOrrkaFmGxCFtX+NCSHFkg$N3rlzYFqyNkCwrOingnDJ/qDQ09yGHgQa8PQfbu7rIE

Alternatively, a SHA512-CRYPT hash:

# doveadm pw -s SHA512-CRYPT
Enter new password:
Retype new password:
{SHA512-CRYPT}$6$qAvxfQ2UbA1QTXSg$SB2aMEK76DBObt.KqTjF5.yDMceaD3dkG2UvrKQD0rZ9PKii/VAn.VS0nBsDqJX18kXieMi8AWJr0f7Ae9dAp/

---

🦋 REPORTING BUGS 🦋

Found a bug? 😭 report it — including your doveconf -n output — to the Dovecot Mailing List ⟨dovecot@dovecot.org⟩. info about reporting bugs lives at: ⟨https://dovecot.org/bugreport.html⟩

---

👑 SEE ALSO 👑

• doveadm(1)

---

and that's the whole page, bestie — this was Dovecot's DOVEADM-PW(1), revision f979264, dated April 2026. no cap, that's everything. go generate some hashes, you absolute icon. 💖✨🎀