Back in the days I were operating some critical systems in a commercial context which employed the Mosquitto broker for internal component communication, these days it is called “Eclipse Mosquitto (TM)” and part of Cedalo’s “Pro Mosquitto MQTT Broker (not TM and not fully FOSS)” aka. “Pro Edition for Mosquitto” (see comparison), which made me follow the development quite closely for some years and even contribute a little here and there.

This made me witness several frustrations from Mosquitto users who wanted to prepare credentials for user authentication on machines which did not have the broker itself nor its tools installed locally (see original trigger question on mosquitto-dev from 2016, and through the years also this, that, there, and some solutions).

The trigger motivated me to investigate and describe the required steps and some PHP code that could perform the needed hash calculation and format the required authentication line for the file supplied to the broker’s password_file config option. This was back in 2016 where only a SHA512 based hash was supported.

I later made a write-up on this blog (part I), which resulted in some readers contacting me for help and clarification. This made me put together a proper script in 2021 which would behave similarly to mosquitto_passwd; mosquitto_passwd.php.

In recent years, another user chipped in on GitHub annoyed by the need to install the broker to generate passwords for use in containers which has now triggered me again, in 2026!, to look into the PBKDF2 method available and default in v2.0 and later (2020-12-03) releases of Mosquitto. This ended up with addition of the -H & -I options for choosing hash method & PBKDF2 iterations to the script for compatibility with mosquitto_passwd (although -I for mosquitto_passwd is completely undocumented, created a PR rectifying that).

So feel free to use mosquitto_passwd.php, it is freely available and distributed under the GNU GPL 3.0 license.