diff --git a/deploy_passwords b/deploy_passwords
new file mode 100755
index 0000000..37c2143
--- /dev/null
+++ b/deploy_passwords
@@ -0,0 +1,5 @@
+#!/usr/bin/env ./sshtool
+
+write_pass deuxfleurs/cluster/$CLUSTER/passwords /root/deploy_tmp_passwords
+cmd 'chpasswd -e < /root/deploy_tmp_passwords'
+cmd rm /root/deploy_tmp_passwords
diff --git a/passwd b/passwd
new file mode 100755
index 0000000..7cc80b6
--- /dev/null
+++ b/passwd
@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+
+cd $(dirname $0)
+
+function usage {
+	echo "Usage: $0 <cluster name> <username>"
+	echo "The cluster name must be the name of a subdirectory of cluster/"
+	exit 1
+}
+
+CLUSTER="$1"
+if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
+	usage
+fi
+
+USERNAME="$2"
+if [ -z "$USERNAME" ]; then
+	usage
+fi
+
+PREFIX="deuxfleurs/cluster/$CLUSTER"
+
+if ! EXISTING_PASSWORDS=$(pass $PREFIX/passwords | egrep -v "^$USERNAME:"); then
+	EXISTING_PASSWORDS=""
+fi
+
+echo "Enter new password for user $USERNAME:"
+NEW_PASSWD=$(openssl passwd -6)
+
+(echo $EXISTING_PASSWORDS; echo $USERNAME:$NEW_PASSWD) | pass insert -m $PREFIX/passwords