[id='securing-passwords-credential-keystores_{context}']
= Securing passwords for credential keystores

{brandname} Server requires a password to access credential keystores.
You can add that password to {brandname} Server configuration in clear text or, as an added layer of security, you can use an external command for the password or you can mask the password.

.Prerequisites

* Set up a credential keystore for {brandname} Server.

.Procedure

Do one of the following:

* Use the [command]`credentials mask` command to obscure the password, for example:
+
[source,options="nowrap",subs=attributes+]
----
bin/cli.sh credentials mask -i 100 -s pepper99 "secret1234!"
----
+
Masked passwords use Password Based Encryption (PBE) and must be in the following format in your {brandname} Server configuration: <MASKED_VALUE;SALT;ITERATION>.

* Use an external command that provides the password as standard output.
+
An external command can be any executable, such as a shell script or binary, that uses `java.lang.Runtime#exec(java.lang.String)`. +
If the command requires parameters, provide them as a space-separated list of strings.
