generate keystore with password secret_password keytool -genseckey -storepass secret_password -keystore test.keystore -storetype JCEKS -keypass key_password get masked string now it is possible using wildfly-elytron-tool.jar ( https://issues.jboss.org/browse/JBEAP-9025 ) java -jar wildfly-elytron-tool.jar credential-store --add myalias --secret secretpassword --location= "test.store1" --uri "cr-store: //test.store?modifiable= true ;create= true ;keyStoreType=JCEKS" --password secret_password --summary --salt 12345678 --iteration 230 --create Alias "myalias" has been successfully stored Credential store command summary: -------------------------------------- /subsystem=elytron/credential-store=test:add(uri= "cr-store: //test.store?modifiable= true ;create= true ;keyStoreType=JCEKS" ,relative-to=jboss.server.data.dir,credential-reference={clear-text= "MASK-KAwLfD1BN8WFhZptWsa17G==;12345678;230" }) [mchoma@localhost bin]$ create keystore with that masked password [standalone@localhost:9990 /] /subsystem=elytron/key-store=a:add(path=test.keystore, relative-to=jboss.server.config.dir, required=true, type=JCEKS, credential-reference= {clear-text=MASK-KAwLfD1BN8WFhZptWsa17G==;12345678;230} ) {"outcome" => "success"}