diff --git a/src/drv_imap.c b/src/drv_imap.c
index d00b43c..72a8fd1 100644
--- a/src/drv_imap.c
+++ b/src/drv_imap.c
@@ -1723,13 +1723,18 @@ ensure_user( imap_server_conf_t *srvc )
 static const char *
 ensure_password( imap_server_conf_t *srvc )
 {
-	if (srvc->pass_cmd) {
+	char *cmd = srvc->pass_cmd;
+
+	if (cmd) {
 		FILE *fp;
 		int ret;
 		char buffer[80];
 
-		flushn();
-		if (!(fp = popen( srvc->pass_cmd, "r" ))) {
+		if (*cmd == '+') {
+			flushn();
+			cmd++;
+		}
+		if (!(fp = popen( cmd, "r" ))) {
 		  pipeerr:
 			sys_error( "Skipping account %s, password command failed", srvc->name );
 			return 0;
diff --git a/src/mbsync.1 b/src/mbsync.1
index 6007557..d525637 100644
--- a/src/mbsync.1
+++ b/src/mbsync.1
@@ -288,11 +288,14 @@ If neither a password nor a password command is specified in the
 configuration file, \fBmbsync\fR will prompt you for a password.
 ..
 .TP
-\fBPassCmd\fR \fIcommand\fR
+\fBPassCmd\fR [\fB+\fR]\fIcommand\fR
 Specify a shell command to obtain a password rather than specifying a
 password directly. This allows you to use password files and agents.
 The command must produce exactly one line on stdout; the trailing newline is
 optional.
+Prepend \fB+\fR to the command to indicate that it produces TTY output
+(e.g., a decryption password prompt); failure to do so will merely produce
+messier output.
 ..
 .TP
 \fBTunnel\fR \fIcommand\fR