OPENSSL-PASSPHRASE-OPTIONS(1ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 openssl-passphrase-options (that's the 1ossl manual, bestie) 🎀

okay so real talk — this is the page for openssl-passphrase-options, and it's basically the group chat where OpenSSL figures out where tf your password is coming from. ✨

✨ SYNOPSIS ✨

openssl command [ options ... ] [ parameters ... ]

🌸 DESCRIPTION 🌸

So like, several OpenSSL commands accept password arguments — usually -passin for the input password and -passout for the output one. And these aren't just "type your password here" vibes; they let the password come from a whole variety of sources. 👑

Both of those options take a single argument, and the format of that argument is literally what this whole page is about (scroll down, it's cute, i promise 🫶).

And if no password argument is given but a password is required? The user gets prompted to enter one — typically read from the current terminal with echoing turned off. So like, nobody sees what you type. privacy slay. 🙈

heads up bestie: character encoding may be relevant here — go check passphrase-encoding(7) for the details. ngl it matters more than you'd think. 💜

⭐ OPTIONS ⭐

🦋 Pass Phrase Option Arguments

Pass phrase arguments can be formatted as follows. pick your fighter:

  • pass:password — the actual password is password. but babes… since the password is visible to utilities (like ps under Unix) this form should only be used where security is not important. it's giving "i left my diary open on the kitchen table". 😭
  • env:var — obtain the password from the environment variable var. and because the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes), this option should be used with caution. lowkey risky, highkey useful. 💀
  • file:pathname — reads the password from the specified file pathname, which can be a regular file, device, or named pipe. Only the first line, up to the newline character, is read from the stream. one line only, she's efficient. ✨

If the same pathname argument is supplied to both -passin and -passout arguments, the first line will be used for the input password, and the next line will be used for the output password. two lines, two passwords, one file — iconic behaviour honestly. 🎀

  • fd:number — reads the password from the file descriptor number. this can be useful for sending data via a pipe, for example. and the same line handling as described for file: applies to passwords read from file descriptors. 🧚
fd: is not supported on Windows. fr fr, don't come for me, that's just what it says. 🫶
  • stdin — reads the password from standard input. same line handling as described for file: applies to passwords read from standard input. classic, reliable, main character energy. 🌈

Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved. 💖

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, no cap 🌸 — this was 3.5.0, dated 2026-09-25, brought to you by the OPENSSL-PASSPHRASE-OPTIONS(1ossl) manpage. go forth and pass your passphrases responsibly bestie 💅✨🍓

📦 where this page comes from