diff --git a/ChangeLog.txt b/ChangeLog.txt
index fc443ff10a..fa5c44b47a 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -10,6 +10,8 @@ Broker:
 Apps:
 - Allow command line arguments to override config file options in
   mosquitto_ctrl. Closes #2010.
+- mosquitto_ctrl: produce an error when requesting a new password if both
+  attempts do not match. Closes #2011.
 
 2.0.5 - 2021-01-11
 ==================
diff --git a/apps/mosquitto_ctrl/dynsec.c b/apps/mosquitto_ctrl/dynsec.c
index 796207e647..53968ab76b 100644
--- a/apps/mosquitto_ctrl/dynsec.c
+++ b/apps/mosquitto_ctrl/dynsec.c
@@ -720,9 +720,8 @@ int dynsec_init(int argc, char *argv[])
 		snprintf(verify_prompt, sizeof(verify_prompt), "Reenter password for %s: ", admin_user);
 		rc = get_password(prompt, verify_prompt, false, password, sizeof(password));
 		if(rc){
-			fprintf(stderr, "Error getting password.\n");
 			mosquitto_lib_cleanup();
-			return 1;
+			return -1;
 		}
 		admin_password = password;
 	}
diff --git a/apps/mosquitto_ctrl/dynsec_client.c b/apps/mosquitto_ctrl/dynsec_client.c
index 45b6d6af2a..d613155386 100644
--- a/apps/mosquitto_ctrl/dynsec_client.c
+++ b/apps/mosquitto_ctrl/dynsec_client.c
@@ -65,6 +65,9 @@ int dynsec_client__create(int argc, char *argv[], cJSON *j_command)
 		rc = get_password(prompt, verify_prompt, true, password_buf, sizeof(password_buf));
 		if(rc == 0){
 			password = password_buf;
+		}else if(rc == 2){
+			fprintf(stderr, "Error: Passwords do not match.\n");
+			return -1;
 		}else{
 			password = NULL;
 			printf("\n");
@@ -163,7 +166,7 @@ int dynsec_client__set_password(int argc, char *argv[], cJSON *j_command)
 		snprintf(verify_prompt, sizeof(verify_prompt), "Reenter password for %s: ", username);
 		rc = get_password(prompt, verify_prompt, false, password_buf, sizeof(password_buf));
 		if(rc){
-			return MOSQ_ERR_INVAL;
+			return -1;
 		}
 		password = password_buf;
 	}else{
diff --git a/apps/mosquitto_passwd/get_password.c b/apps/mosquitto_passwd/get_password.c
index a3113d1a59..aba556566d 100644
--- a/apps/mosquitto_passwd/get_password.c
+++ b/apps/mosquitto_passwd/get_password.c
@@ -135,7 +135,7 @@ int get_password(const char *prompt, const char *verify_prompt, bool quiet, char
 			if(!quiet){
 				fprintf(stderr, "Error: Passwords do not match.\n");
 			}
-			return 1;
+			return 2;
 		}
 	}