diff --git a/.gitignore b/.gitignore
index 16b9ed2..94e541d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 /.idea/
 /.vscode/
+/*.auth
 /*.iso
+/*.sum
 /SHA256SUMS
 /SHA256SUMS.sign
diff --git a/README.md b/README.md
index d87f7d9..9fa627c 100644
--- a/README.md
+++ b/README.md
@@ -66,7 +66,7 @@ echo "ssh-ed25519 AAAA... bar" >> configs/authorized_keys
 
 ### Password
 
-If the `-p` flag is not set, a random admin password will be generated.
+If the `-p` flag is not set, a random admin password will be generated, printed to stdout and written to `<out_file>.auth`.
 
 ### Hostname
 
diff --git a/build.sh b/build.sh
index fa4d4d4..3a9d593 100755
--- a/build.sh
+++ b/build.sh
@@ -134,6 +134,10 @@ xorriso -indev "${iso_file}" \
 echo "user: ${username}"
 echo "pass: ${password}"
 
+if test "${password_mask}" == "false"; then
+    printf "user: %s\npass: %s\n" "${username}" "${password}" > "${out_file}.auth"
+fi
+
 rm -rf "${workdir}"
 
 sha256sum "${out_file}" >"${out_file}.sum"