diff --git a/config.h b/config.h
index 016ae86..790b27f 100644
--- a/config.h
+++ b/config.h
@@ -26,12 +26,17 @@
 /* which versions? */
 # define HAVE_GETOPT_LONG
 # define HAVE_GETADDRINFO
+# define HAVE_READPASSPHRASE
 # define ENABLE_NLS
 # ifndef LOCALEDIR
 #  define LOCALEDIR "/usr/local/share/locale"
 # endif
 #endif
 
+#if defined OpenBSD
+# define HAVE_READPASSPHRASE
+#endif
+
 /* needs unistd.h */
 #if defined _POSIX_C_SOURCE && _POSIX_C_SOURCE >= 200112L
 # define HAVE_GETADDRINFO
@@ -41,6 +46,7 @@
 #if defined __APPLE__ && defined __MACH__
 # define HAVE_GETOPT_LONG
 # define HAVE_GETADDRINFO
+# define HAVE_READPASSPHRASE
 # define HAVE_BSDICRYPT
 #endif
 
diff --git a/mkpasswd.c b/mkpasswd.c
index f403861..646be43 100644
--- a/mkpasswd.c
+++ b/mkpasswd.c
@@ -47,6 +47,9 @@
 #ifdef HAVE_GETTIMEOFDAY
 #include <sys/time.h>
 #endif
+#ifdef HAVE_READPASSPHRASE
+#include <readpassphrase.h>
+#endif
 
 /* Application-specific */
 #include "version.h"
@@ -387,11 +390,21 @@ int main(int argc, char *argv[])
 	    exit(2);
 	}
     } else {
+#ifdef HAVE_READPASSPHRASE
+	const size_t size = 128;
+
+	password = NOFAIL(malloc(size));
+	if (!readpassphrase(_("Password: "), password, size, 0)) {
+	    perror("readpassphrase");
+	    exit(2);
+	}
+#else
 	password = getpass(_("Password: "));
 	if (!password) {
 	    perror("getpass");
 	    exit(2);
 	}
+#endif
     }
 
     {