Index: usr.sbin/pw/pw.h
===================================================================
--- usr.sbin/pw/pw.h
+++ usr.sbin/pw/pw.h
@@ -93,6 +93,7 @@
 int nis_update(void);
 
 int boolean_val(char const * str, int dflt);
+int passwd_val(char const * str, int dflt);
 char const *boolean_str(int val);
 char *newstr(char const * p);
 
Index: usr.sbin/pw/pw_conf.c
===================================================================
--- usr.sbin/pw/pw_conf.c
+++ usr.sbin/pw/pw_conf.c
@@ -186,6 +186,22 @@
 		for (i = 0; boolfalse[i]; i++)
 			if (strcmp(str, boolfalse[i]) == 0)
 				return 0;
+	}
+	return dflt;
+}
+
+int
+passwd_val(char const * str, int dflt)
+{
+	if ((str = unquote(str)) != NULL) {
+		int             i;
+
+		for (i = 0; booltrue[i]; i++)
+			if (strcmp(str, booltrue[i]) == 0)
+				return 1;
+		for (i = 0; boolfalse[i]; i++)
+			if (strcmp(str, boolfalse[i]) == 0)
+				return 0;
 
 		/*
 		 * Special cases for defaultpassword
@@ -194,6 +210,8 @@
 			return -1;
 		if (strcmp(str, "none") == 0)
 			return -2;
+
+		errx(1, "Invalid value for default password");
 	}
 	return dflt;
 }
@@ -258,7 +276,7 @@
 #endif
 			switch (i) {
 			case _UC_DEFAULTPWD:
-				config.default_password = boolean_val(q, 1);
+				config.default_password = passwd_val(q, 1);
 				break;
 			case _UC_REUSEUID:
 				config.reuse_uids = boolean_val(q, 0);
Index: usr.sbin/pw/pw_user.c
===================================================================
--- usr.sbin/pw/pw_user.c
+++ usr.sbin/pw/pw_user.c
@@ -1315,7 +1315,7 @@
 
 	mix_config(cmdcnf, cnf);
 	if (default_passwd)
-		cmdcnf->default_password = boolean_val(default_passwd,
+		cmdcnf->default_password = passwd_val(default_passwd,
 		    cnf->default_password);
 	if (genconf) {
 		if (name != NULL)
@@ -1717,7 +1717,7 @@
 		if (lc == NULL || login_setcryptfmt(lc, "sha512", NULL) == NULL)
 			warn("setting crypt(3) format");
 		login_close(lc);
-		cnf->default_password = boolean_val(passwd,
+		cnf->default_password = passwd_val(passwd,
 		    cnf->default_password);
 		pwd->pw_passwd = pw_password(cnf, pwd->pw_name, dryrun);
 		edited = true;
Index: usr.sbin/pw/tests/pw_useradd.sh
===================================================================
--- usr.sbin/pw/tests/pw_useradd.sh
+++ usr.sbin/pw/tests/pw_useradd.sh
@@ -325,6 +325,39 @@
 		${PW} useradd foo
 }
 
+atf_test_case user_add_w_error
+user_add_w_error_body() {
+	populate_etc_skel
+
+	atf_check -s exit:1 -e match:"pw: Invalid value for default password" \
+		${PW} useradd foo -w invalid_value
+}
+
+atf_test_case user_add_w_no
+user_add_w_no_body() {
+	populate_etc_skel
+
+	atf_check -s exit:0 ${PW} useradd foo -w no
+	atf_check -s exit:0 -o match:"^foo:\*" grep "^foo:" $HOME/master.passwd
+}
+
+atf_test_case user_add_w_none
+user_add_w_none_body() {
+	populate_etc_skel
+
+	atf_check -s exit:0 ${PW} useradd foo -w none
+	atf_check -s exit:0 -o match:"^foo::" grep "^foo:" $HOME/master.passwd
+}
+
+atf_test_case user_add_w_random
+user_add_w_random_body() {
+	populate_etc_skel
+
+	atf_check -s exit:0 -o match:"^[a-zA-Z0-9_]*" \
+		${PW} useradd foo -w random
+	atf_check -s exit:0 -o match:'^foo:\$.' grep "^foo:" $HOME/master.passwd
+}
+
 atf_test_case user_add_w_yes
 user_add_w_yes_body() {
 	populate_etc_skel
@@ -332,10 +365,6 @@
 	atf_check -s exit:0 \
 		-o match:'^foo:\$.*' \
 		grep "^foo" ${HOME}/master.passwd
-	atf_check -s exit:0 ${PW} usermod foo -w yes
-	atf_check -s exit:0 \
-		-o match:'^foo:\$.*' \
-		grep "^foo" ${HOME}/master.passwd
 }
 
 atf_test_case user_add_with_pw_conf
@@ -380,6 +409,10 @@
 	atf_add_test_case user_add_uid_too_large
 	atf_add_test_case user_add_bad_shell
 	atf_add_test_case user_add_already_exists
+	atf_add_test_case user_add_w_error
+	atf_add_test_case user_add_w_no
+	atf_add_test_case user_add_w_none
+	atf_add_test_case user_add_w_random
 	atf_add_test_case user_add_w_yes
 	atf_add_test_case user_add_with_pw_conf
 }
Index: usr.sbin/pw/tests/pw_usermod.sh
===================================================================
--- usr.sbin/pw/tests/pw_usermod.sh
+++ usr.sbin/pw/tests/pw_usermod.sh
@@ -203,6 +203,52 @@
 	atf_check -s exit:0 ${PW} usermod foo -u 5000
 }
 
+atf_test_case user_mod_w_error
+user_mod_w_error_body() {
+	populate_etc_skel
+
+	atf_check -s exit:0 ${PW} useradd foo
+	atf_check -s exit:1 -e match:"pw: Invalid value for default password" \
+		${PW} usermod foo -w invalid_value
+}
+
+atf_test_case user_mod_w_no
+user_mod_w_no_body() {
+	populate_etc_skel
+
+	atf_check -s exit:0 ${PW} useradd foo
+	atf_check -s exit:0 ${PW} usermod foo -w no
+	atf_check -s exit:0 -o match:"^foo:\*" grep "^foo:" $HOME/master.passwd
+}
+
+atf_test_case user_mod_w_none
+user_mod_w_none_body() {
+	populate_etc_skel
+
+	atf_check -s exit:0 ${PW} useradd foo
+	atf_check -s exit:0 ${PW} usermod foo -w none
+	atf_check -s exit:0 -o match:"^foo::" grep "^foo:" $HOME/master.passwd
+}
+
+atf_test_case user_mod_w_random
+user_mod_w_random_body() {
+	populate_etc_skel
+
+	atf_check -s exit:0 ${PW} useradd foo
+	atf_check -s exit:0 -o match:"^[a-zA-Z0-9_]*" \
+		${PW} usermod foo -w random
+	atf_check -s exit:0 -o match:'^foo:\$.' grep "^foo:" $HOME/master.passwd
+}
+
+atf_test_case user_mod_w_yes
+user_mod_w_yes_body() {
+	populate_etc_skel
+
+	atf_skip "I don't know how to test this"
+	# XXX How can we test the value of foo's password?
+}
+
+
 atf_init_test_cases() {
 	atf_add_test_case user_mod
 	atf_add_test_case user_mod_noupdate
@@ -219,4 +265,9 @@
 	atf_add_test_case user_mod_H
 	atf_add_test_case user_mod_renamehome
 	atf_add_test_case user_mod_uid
+	atf_add_test_case user_mod_w_error
+	atf_add_test_case user_mod_w_no
+	atf_add_test_case user_mod_w_none
+	atf_add_test_case user_mod_w_random
+	atf_add_test_case user_mod_w_yes
 }