diff --git a/Zpkgs/krebs/default.nix b/Zpkgs/krebs/default.nix
index be8f72011..883890476 100644
--- a/Zpkgs/krebs/default.nix
+++ b/Zpkgs/krebs/default.nix
@@ -8,4 +8,5 @@ pkgs //
 {
   github-hosts-sync = callPackage ./github-hosts-sync.nix {};
   github-known_hosts = callPackage ./github-known_hosts.nix {};
+  hashPassword = callPackage ./hashPassword.nix {};
 }
diff --git a/Zpkgs/krebs/hashPassword.nix b/Zpkgs/krebs/hashPassword.nix
new file mode 100644
index 000000000..a10340cc4
--- /dev/null
+++ b/Zpkgs/krebs/hashPassword.nix
@@ -0,0 +1,16 @@
+{ lib, pkgs, ... }:
+
+pkgs.writeScriptBin "hashPassword" ''
+  #! /bin/sh
+  # usage: hashPassword
+  set -euf
+
+  export PATH=${lib.makeSearchPath "bin" (with pkgs; [
+    coreutils
+    mkpasswd
+    openssl
+  ])}
+
+  salt=$(openssl rand -base64 16 | tr -d '+=' | head -c 16)
+  exec mkpasswd -m sha-512 -S "$salt"
+''