This documentation is for Dovecot v2.x, see wiki1 for v1.x documentation.


This file is compatible with a normal /etc/passwd file, and a password file used by libpam-pwdfile PAM plugin. It's in the following format:


For a password database it's enough to have only the user and password fields. For a user database, you need to set also uid, gid and preferably also home (see VirtualUsers). (gecos) and (shell) fields are unused by Dovecot.

The password field can be in four formats:

extra_fields is a space-separated list of key=value pairs which can be used to set various passdb settings and userdb settings. Keys which begin with a userdb_ prefix are used for userdb, others are used for passdb. So for example if you wish to override mail_location setting for one user, use userdb_mail=mbox:~/mail. Variable expansion is done for extra_fields.

Empty lines and lines beginning with '#' character are ignored.

Multiple passwd files

You can use all the variables in the passwd-file filenames, for example:

passdb {
  driver = passwd-file
  # Each domain has a separate passwd-file:
  args = /etc/auth/%d/passwd

Passwd-file args


passdb {
  driver = passwd-file
  args = scheme=plain-md5 username_format=%n /etc/imap.passwd
userdb {
  driver = passwd-file
  args = username_format=%n /etc/imap.passwd
  default_fields = uid=vmail gid=vmail home=/home/vmail/%u

This file can be used as a passdb:


passdb with extra fields:


This file can be used as both a passwd and a userdb:

user:{plain}pass:1000:1000::/home/user::userdb_mail=maildir:~/Maildir allow_nets=

Passwd as a password database on FreeBSD

On FreeBSD, passwd doesn't work as a password database because the password field is replaced by a *. But you can convert /etc/master.passwd into a passwd-file. In /etc/master.passwd, a password of * indicates that password authentication is disabled, so you might as well exclude those.

# grep -v '*' master.passwd > file-with-encrypted-passwords
# chmod 400 file-with-encrypted-passwords
# chown dovecot file-with-encrypted-passwords

Then use:

passdb {
  driver = passwd-file
  args = path-to-file-with-encrypted-passwords