pwtool(1)

okay so bestie 💖 you just opened pwtool(1), straight out of the User Manual, and honestly? you're about to eat. this is section 1 of the manual for pwtool, and it's gonna walk you through making passwords that don't make you want to cry and creating accounts without re-typing a single character. let's get into it 🫶

---

🎀 NAME 🎀

pwtool — a convenience tool to make sane passwords and account creations ✨

🌈 SYNOPSIS 🌈

no cap, here is every single shape this command can take. copy-paste city, bestie:

pwtool

pwtool --number N

pwtool --length N

pwtool --[only]alpha

pwtool --[only]numeric

pwtool --[only]extended

pwtool --[only]lowercase

pwtool --[only]uppercase

pwtool --md5 [--salt STRING]

pwtool --des [--salt STRING]

pwtool --bcrypt [--salt STRING]

pwtool --sha[1,256,512] [--salt STRING]

pwtool --username name

pwtool --database name

pwtool --createdatabase

pwtool --password STRING

pwtool --keepassdb PATH

pwtool --keepassphrase STRING

pwtool --totp STRING

pwtool --totpfmt

pwtool --totpstep NUMBER

that's a whole lot of flags and every single one of them is real, ok? don't @ me 💅

💜 DESCRIPTION 💜

so like, pwtool is a utility that generates account passwords in a variety of formats, and it drops helper output on stdout for you. by default the password strings are made of letters and numbers, specifically so they're easy to grab with your mouse 🖱️ iconic behaviour honestly.

if you just want a simple password to use in a script, it's giving this:

pwtool --number 1
PVTevLyA9r

and if you run pwtool with no options at all? it generates a whole screen of passwords. just pick one you like and go, bestie 🌸

as well as all the flexible password generation options, a main goal (the main character goal, if you will) is to output user creation strings you can copy and paste/execute as stdin, so operators never have to re-type passwords. the way that's a quality-of-life win is unreal 🫶

crypts can be based on user supplied strings, either via the --password option or the PASSWORD environment variable 🔑

the --format string can expand values, like this:

pwtool --database billing --username wonkeydonkey --password hunter2 --servername webby --number 1 --format 'DB: %{database}\nUSR: %{username}\nPASSWORD: %{password}\nSERVER: %{servername}\n'

other strings, such as --mysqlfmt, --pgfmt, --mysqluserfmt, and --userfmt, can straight up generate copy/paste shell commands for you. obsessed 😭

pwtool --username wonkeydonkey --number 1 --userfmt

useradd -m -s /bin/bash -p '$5$hYhnxam4j/chBu3V$BsZsRl4nj6DTpEdFMfLuerPFR0xvCJmeGQCUjuG9qM1' wonkeydonkey # Y9YgmSyv1A

pwtool --username wonkeydonkey --database circus --createdatabase --number 1 --mysqlfmt

create database circus; grant all privileges on circus.* to wonkeydonkey@'%' identified with mysql_native_password as '*21c0a42c1bb43ff6b56226a6a65a8859dd077497'; -- # VfKptnR2ft

optionally, a salt string can be provided with --salt 🧂

and if --keepassdb is specified, entries will be added to the DB. here's the tea though: if the file exists, then the password for the DB should be specified either in --keepassphrase or the KEEPASSPHRASE environment. if the file does not exist, it will be created. and if the passphrase is not specified, one will be created using the runtime configuration and written to stdout ✨

---

🔥 TOTP 🔥

pwtool can also work as a TOTP CLI and display TOTP authentication strings 👑

if you want to leave a TOTP authentication display chillin' in your terminal, it can run like this:

TOTP="name=metalisbest,key=bar" pwtool --totpfmt

it will then run and leave a display like this:

762269 [#################             ] metalisbest

and if you have multiple accounts, they can be displayed like this:

TOTP="name=metalisbest,key=bar;name=grungeisbest,key=baz" pwtool --totpfmt

523200 [#######                       ] metalisbest
523200 [#######                       ] grungeisbest

the following key=value pairs are supported, bestie 💖

• key / totp — the totp string
• name / username — a meaningful name for this key
• step — number of step seconds
• digits — the length of the output
• algo — which hmac to use (sha1, sha256, sha512)
• seconds — a user-defined time

---

👑 AUTHORS 👑

Ed Neville (ed-pwtool@s5h.net). periodt 💅

---

and that's the whole page, bestie 🦋 this was pwtool 0.12.0, dated 27 December 2025 — go make some passwords, you're the main character now 🌈⭐