diff --git a/core/installer/derived.go b/core/installer/derived.go
index ada4e95..cf792ef 100644
--- a/core/installer/derived.go
+++ b/core/installer/derived.go
@@ -4,6 +4,8 @@
 	"fmt"
 	"html/template"
 	"strings"
+
+	"github.com/sethvargo/go-password/password"
 )
 
 const defaultClusterName = "default"
@@ -92,6 +94,13 @@
 					"private": string(key.RawPrivateKey()),
 				}
 			}
+			if def.Kind() == KindPassword {
+				psswd, err := GeneratePassword()
+				if err != nil {
+					return nil, err
+				}
+				ret[k] = psswd
+			}
 			if def.Kind() == KindVPNAuthKey {
 				enabled := true
 				if v, ok := def.Meta()["enabledField"]; ok {
@@ -135,6 +144,8 @@
 			ret[k] = v
 		case KindVPNAuthKey:
 			ret[k] = v
+		case KindPassword:
+			ret[k] = v
 		case KindArrayString:
 			a, ok := v.([]string)
 			if !ok {
@@ -234,6 +245,8 @@
 			ret[k] = v
 		case KindVPNAuthKey:
 			ret[k] = v
+		case KindPassword:
+			ret[k] = v
 		case KindArrayString:
 			a, ok := v.([]string)
 			if !ok {
@@ -335,3 +348,7 @@
 	}
 	return nil, fmt.Errorf("Cluster not found: %s", name)
 }
+
+func GeneratePassword() (string, error) {
+	return password.Generate(20, 5, 0, false, true)
+}