> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-cli/command-reference/plugins/password-rotation.md).

# Password Rotation Commands

Commands for performing password rotations on target systems.

{% hint style="success" %}
Keeper has also launched a zero-trust Password Rotation feature with KeeperPAM. This new capability is recommended for most password rotation use cases. The Documentation is linked below:

* [Password Rotation with KeeperPAM](/keeperpam/privileged-access-manager/password-rotation.md)
* Commander [KeeperPAM commands](/keeperpam/commander-cli/command-reference/keeperpam-commands.md)
  {% endhint %}

## Rotation Commands

#### Keeper Command Reference

Whether using the interactive shell, CLI or JSON config file, Keeper supports the following commands, each command supports additional parameters and options.

To get help on a particular command, run:

`help <command>`

| Command         | Explanation                                                                                    |
| --------------- | ---------------------------------------------------------------------------------------------- |
| `rotate` or `r` | Rotate the password in a record                                                                |
| `set`           | Set environment variables that can be used for substitution within other commands or arguments |
| `echo`          | Display environmental variables                                                                |

### rotate command:

**Command:** `rotate` or r

**Detail**: Rotate a record's password

To be eligible for rotation, a record must have the custom field 'cmdr:plugin'='noop'

**Parameters:**

Record name or UID to rotate

**Switches:**

\--print display updated record content after rotation

\--match \<REGULAR EXPRESSION> select all records that match this expression to rotate

\--password \<NEW PASSWORD> sets a new password. Commander generates random password if switch omitted. Ignored when passwords are rotated with --match parameter.

**Examples:**

```
rotate servers/dev
rotate BhRRhjeL4armInSMqv2_zQ --print
rotate --match [0-z]*\machine
rotate BhRRhjeL4armInSMqv2_zQ --password "XXX"
```

1. Rotate the password of the record titled "dev" in the "servers" folder
2. Rotate the password of the record with the given UID
3. Rotate the password of all records that end with "machine" (Using regex)
4. Rotate the password of the give record UID with the specific password provided

{% hint style="info" %}
When using `--password`, the value must not contain `'`, `"`, `;`, `\`, or `--`. Rotation will fail if any of these characters are present. If `--password` is omitted, Commander generates a compliant password automatically.\
For more information and examples see [Connection to hosts documentation](/keeperpam/commander-cli/command-reference/connection-commands/connection-to-hosts.md)
{% endhint %}

### set command:

**Command:** `set`

**Detail:** Set an environment variable

**Parameters:**

environment name, value to set

format:

`set <name> <value>`

**Examples:**

```
set MySecret XXX
```

Set the MySecret variable to XXX

### echo command:

**Command:** `echo`

**Detail:** Display environmental variables

**Parameters:**

argument to display (optional)

format:

`echo ${<variable>}`

If no argument is given, all environment variables are shown

**Examples:**

```
echo
echo ${MySecret}
```

1. Display all currently set environment variables
2. Display the value for the MySecret variable


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/commander-cli/command-reference/plugins/password-rotation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.