diff --git a/src/server_config.h b/src/server_config.h
index 0a5f95a0..e5f3c52c 100644
--- a/src/server_config.h
+++ b/src/server_config.h
@@ -498,6 +498,18 @@ int nc_server_config_add_ssh_user_authkey(const struct ly_ctx *ctx, const char *
  */
 int nc_server_config_del_ssh_user_authkey(const char *endpt_name, const char *user_name, struct lyd_node **config);
 
+/**
+ * @brief Hashes a clear-text password the way the server stores it in its configuration.
+ *
+ * Produces a value usable as an 'ietf-ssh-server' hashed-password, that is a crypt(3) SHA-512
+ * digest under a freshly generated random salt ("$6$<salt>$<digest>").
+ *
+ * @param[in] password Clear-text password to hash.
+ * @param[out] hashed_password Hashed password, memory is allocated and has to be freed by the caller.
+ * @return 0 on success, non-zero otherwise.
+ */
+int nc_server_config_hash_password(const char *password, char **hashed_password);
+
 /**
  * @brief Creates new YANG configuration data nodes for an SSH user's password authentication method.
  *
diff --git a/src/server_config_util_ssh.c b/src/server_config_util_ssh.c
index bbb8e630..7de05850 100644
--- a/src/server_config_util_ssh.c
+++ b/src/server_config_util_ssh.c
@@ -490,9 +490,8 @@ nc_server_config_ch_del_ssh_user_authkey(const char *client_name, const char *en
             "public-keys/libnetconf2-netconf-server:use-system-keys", client_name, endpt_name, user_name);
 }
 
-static int
-_nc_server_config_add_ssh_user_password(const struct ly_ctx *ctx, const char *tree_path,
-        const char *password, struct lyd_node **config)
+API int
+nc_server_config_hash_password(const char *password, char **hashed_password)
 {
     int ret = 0;
     size_t i;
@@ -502,6 +501,10 @@ _nc_server_config_add_ssh_user_password(const struct ly_ctx *ctx, const char *tr
     unsigned char rnd[16];
     static const char itoa64[] = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 
+    NC_CHECK_ARG_RET(NULL, password, hashed_password, 1);
+
+    *hashed_password = NULL;
+
     cdata = calloc(1, sizeof *cdata);
     NC_CHECK_ERRMEM_GOTO(!cdata, ret = 1, cleanup);
 
@@ -527,16 +530,32 @@ _nc_server_config_add_ssh_user_password(const struct ly_ctx *ctx, const char *tr
         goto cleanup;
     }
 
-    ret = nc_server_config_append(ctx, tree_path, "hashed-password", hashed_pw, config);
-    if (ret) {
-        goto cleanup;
-    }
+    /* crypt_r() returns a pointer into cdata, which is freed below */
+    *hashed_password = strdup(hashed_pw);
+    NC_CHECK_ERRMEM_GOTO(!*hashed_password, ret = 1, cleanup);
 
 cleanup:
     free(cdata);
     return ret;
 }
 
+static int
+_nc_server_config_add_ssh_user_password(const struct ly_ctx *ctx, const char *tree_path,
+        const char *password, struct lyd_node **config)
+{
+    int ret = 0;
+    char *hashed_pw = NULL;
+
+    if (nc_server_config_hash_password(password, &hashed_pw)) {
+        return 1;
+    }
+
+    ret = nc_server_config_append(ctx, tree_path, "hashed-password", hashed_pw, config);
+
+    free(hashed_pw);
+    return ret;
+}
+
 API int
 nc_server_config_add_ssh_user_password(const struct ly_ctx *ctx, const char *endpt_name,
         const char *user_name, const char *password, struct lyd_node **config)