#!/usr/bin/env bash
set -euo pipefail

read -r -s -p "Password: " pw; echo
read -r -s -p "Confirm:  " pw2; echo
[[ "$pw" == "$pw2" ]] || { echo "ERROR: passwords do not match" >&2; exit 1; }

# SHA-512 crypt: produces $6$...
hash=$(openssl passwd -6 -stdin <<<"$pw")

printf '%s\n' "$hash"