diff --git a/api/api.pb.go b/api/api.pb.go
index fbe8da060993a1ff899da3780c7f3021ed186f4e..5b11eaef9e737a859adde7634afe30829a4de2a4 100644
--- a/api/api.pb.go
+++ b/api/api.pb.go
@@ -21,6 +21,8 @@ It has these top-level messages:
 	UpdatePasswordResp
 	DeletePasswordReq
 	DeletePasswordResp
+	ListPasswordReq
+	ListPasswordResp
 	VersionReq
 	VersionResp
 */
@@ -202,6 +204,32 @@ func (m *DeletePasswordResp) String() string            { return proto.CompactTe
 func (*DeletePasswordResp) ProtoMessage()               {}
 func (*DeletePasswordResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
 
+// ListPasswordReq is a request to enumerate passwords.
+type ListPasswordReq struct {
+}
+
+func (m *ListPasswordReq) Reset()                    { *m = ListPasswordReq{} }
+func (m *ListPasswordReq) String() string            { return proto.CompactTextString(m) }
+func (*ListPasswordReq) ProtoMessage()               {}
+func (*ListPasswordReq) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
+
+// ListPasswordResp returs a list of passwords.
+type ListPasswordResp struct {
+	Passwords []*Password `protobuf:"bytes,1,rep,name=passwords" json:"passwords,omitempty"`
+}
+
+func (m *ListPasswordResp) Reset()                    { *m = ListPasswordResp{} }
+func (m *ListPasswordResp) String() string            { return proto.CompactTextString(m) }
+func (*ListPasswordResp) ProtoMessage()               {}
+func (*ListPasswordResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
+
+func (m *ListPasswordResp) GetPasswords() []*Password {
+	if m != nil {
+		return m.Passwords
+	}
+	return nil
+}
+
 // VersionReq is a request to fetch version info.
 type VersionReq struct {
 }
@@ -209,7 +237,7 @@ type VersionReq struct {
 func (m *VersionReq) Reset()                    { *m = VersionReq{} }
 func (m *VersionReq) String() string            { return proto.CompactTextString(m) }
 func (*VersionReq) ProtoMessage()               {}
-func (*VersionReq) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
+func (*VersionReq) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{14} }
 
 // VersionResp holds the version info of components.
 type VersionResp struct {
@@ -223,7 +251,7 @@ type VersionResp struct {
 func (m *VersionResp) Reset()                    { *m = VersionResp{} }
 func (m *VersionResp) String() string            { return proto.CompactTextString(m) }
 func (*VersionResp) ProtoMessage()               {}
-func (*VersionResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
+func (*VersionResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{15} }
 
 func init() {
 	proto.RegisterType((*Client)(nil), "api.Client")
@@ -238,6 +266,8 @@ func init() {
 	proto.RegisterType((*UpdatePasswordResp)(nil), "api.UpdatePasswordResp")
 	proto.RegisterType((*DeletePasswordReq)(nil), "api.DeletePasswordReq")
 	proto.RegisterType((*DeletePasswordResp)(nil), "api.DeletePasswordResp")
+	proto.RegisterType((*ListPasswordReq)(nil), "api.ListPasswordReq")
+	proto.RegisterType((*ListPasswordResp)(nil), "api.ListPasswordResp")
 	proto.RegisterType((*VersionReq)(nil), "api.VersionReq")
 	proto.RegisterType((*VersionResp)(nil), "api.VersionResp")
 }
@@ -263,6 +293,8 @@ type DexClient interface {
 	UpdatePassword(ctx context.Context, in *UpdatePasswordReq, opts ...grpc.CallOption) (*UpdatePasswordResp, error)
 	// DeletePassword deletes the password.
 	DeletePassword(ctx context.Context, in *DeletePasswordReq, opts ...grpc.CallOption) (*DeletePasswordResp, error)
+	// ListPassword lists all password entries.
+	ListPasswords(ctx context.Context, in *ListPasswordReq, opts ...grpc.CallOption) (*ListPasswordResp, error)
 	// GetVersion returns version information of the server.
 	GetVersion(ctx context.Context, in *VersionReq, opts ...grpc.CallOption) (*VersionResp, error)
 }
@@ -320,6 +352,15 @@ func (c *dexClient) DeletePassword(ctx context.Context, in *DeletePasswordReq, o
 	return out, nil
 }
 
+func (c *dexClient) ListPasswords(ctx context.Context, in *ListPasswordReq, opts ...grpc.CallOption) (*ListPasswordResp, error) {
+	out := new(ListPasswordResp)
+	err := grpc.Invoke(ctx, "/api.Dex/ListPasswords", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *dexClient) GetVersion(ctx context.Context, in *VersionReq, opts ...grpc.CallOption) (*VersionResp, error) {
 	out := new(VersionResp)
 	err := grpc.Invoke(ctx, "/api.Dex/GetVersion", in, out, c.cc, opts...)
@@ -342,6 +383,8 @@ type DexServer interface {
 	UpdatePassword(context.Context, *UpdatePasswordReq) (*UpdatePasswordResp, error)
 	// DeletePassword deletes the password.
 	DeletePassword(context.Context, *DeletePasswordReq) (*DeletePasswordResp, error)
+	// ListPassword lists all password entries.
+	ListPasswords(context.Context, *ListPasswordReq) (*ListPasswordResp, error)
 	// GetVersion returns version information of the server.
 	GetVersion(context.Context, *VersionReq) (*VersionResp, error)
 }
@@ -440,6 +483,24 @@ func _Dex_DeletePassword_Handler(srv interface{}, ctx context.Context, dec func(
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Dex_ListPasswords_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPasswordReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).ListPasswords(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/api.Dex/ListPasswords",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).ListPasswords(ctx, req.(*ListPasswordReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Dex_GetVersion_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(VersionReq)
 	if err := dec(in); err != nil {
@@ -482,6 +543,10 @@ var _Dex_serviceDesc = grpc.ServiceDesc{
 			MethodName: "DeletePassword",
 			Handler:    _Dex_DeletePassword_Handler,
 		},
+		{
+			MethodName: "ListPasswords",
+			Handler:    _Dex_ListPasswords_Handler,
+		},
 		{
 			MethodName: "GetVersion",
 			Handler:    _Dex_GetVersion_Handler,
@@ -494,42 +559,45 @@ var _Dex_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("api/api.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 579 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x8c, 0x54, 0xcb, 0x6e, 0xdb, 0x3a,
-	0x10, 0x8d, 0x2d, 0x3f, 0xe4, 0xf1, 0x9b, 0xc8, 0x4d, 0x14, 0xdf, 0x8d, 0xc3, 0xa0, 0x80, 0xb3,
-	0x49, 0x90, 0x14, 0x68, 0x17, 0x45, 0xbb, 0x71, 0xfa, 0xda, 0x05, 0x02, 0xdc, 0x65, 0x05, 0xc5,
-	0x9a, 0x26, 0x04, 0x14, 0x89, 0x21, 0xa9, 0x3a, 0xfd, 0x80, 0x7e, 0x58, 0xff, 0xac, 0x20, 0x45,
-	0xbb, 0x92, 0xec, 0xc2, 0xdd, 0xf1, 0x1c, 0xce, 0x9c, 0xd1, 0xcc, 0x19, 0x0a, 0xfa, 0x21, 0x67,
-	0x97, 0x21, 0x67, 0x17, 0x5c, 0xa4, 0x2a, 0x25, 0x4e, 0xc8, 0x19, 0xfd, 0x55, 0x83, 0xd6, 0x3c,
-	0x66, 0x98, 0x28, 0x32, 0x80, 0x3a, 0x8b, 0xbc, 0xda, 0xb4, 0x36, 0xeb, 0xf8, 0x75, 0x16, 0x91,
-	0x23, 0x68, 0x49, 0x5c, 0x0a, 0x54, 0x5e, 0xdd, 0x70, 0x16, 0x91, 0x33, 0xe8, 0x0b, 0x8c, 0x98,
-	0xc0, 0xa5, 0x0a, 0x32, 0xc1, 0xa4, 0xe7, 0x4c, 0x9d, 0x59, 0xc7, 0xef, 0xad, 0xc9, 0x85, 0x60,
-	0x52, 0x07, 0x29, 0x91, 0x49, 0x85, 0x51, 0xc0, 0x11, 0x85, 0xf4, 0x1a, 0x79, 0x90, 0x25, 0x6f,
-	0x35, 0xa7, 0x2b, 0xf0, 0xec, 0x2e, 0x66, 0x4b, 0xaf, 0x39, 0xad, 0xcd, 0x5c, 0xdf, 0x22, 0x42,
-	0xa0, 0x91, 0x84, 0x8f, 0xe8, 0xb5, 0x4c, 0x5d, 0x73, 0x26, 0x27, 0xe0, 0xc6, 0xe9, 0x7d, 0x1a,
-	0x64, 0x22, 0xf6, 0xda, 0x86, 0x6f, 0x6b, 0xbc, 0x10, 0x31, 0x7d, 0x05, 0xc3, 0xb9, 0xc0, 0x50,
-	0x61, 0xde, 0x88, 0x8f, 0x4f, 0xe4, 0x0c, 0x5a, 0x4b, 0x03, 0x4c, 0x3f, 0xdd, 0xeb, 0xee, 0x85,
-	0xee, 0xdb, 0xde, 0xdb, 0x2b, 0xfa, 0x15, 0x46, 0xe5, 0x3c, 0xc9, 0xc9, 0x0b, 0x18, 0x84, 0xb1,
-	0xc0, 0x30, 0xfa, 0x11, 0xe0, 0x33, 0x93, 0x4a, 0x1a, 0x01, 0xd7, 0xef, 0x5b, 0xf6, 0xbd, 0x21,
-	0x0b, 0xfa, 0xf5, 0xbf, 0xeb, 0x9f, 0xc2, 0xf0, 0x06, 0x63, 0x2c, 0x7e, 0x57, 0x65, 0xc6, 0xf4,
-	0x12, 0x46, 0xe5, 0x10, 0xc9, 0xc9, 0xff, 0xd0, 0x49, 0x52, 0x15, 0x7c, 0x4b, 0xb3, 0x24, 0xb2,
-	0xd5, 0xdd, 0x24, 0x55, 0x1f, 0x34, 0xa6, 0x0c, 0xdc, 0xdb, 0x50, 0xca, 0x55, 0x2a, 0x22, 0x72,
-	0x08, 0x4d, 0x7c, 0x0c, 0x59, 0x6c, 0xf5, 0x72, 0xa0, 0x87, 0xf7, 0x10, 0xca, 0x07, 0xf3, 0x61,
-	0x3d, 0xdf, 0x9c, 0xc9, 0x04, 0xdc, 0x4c, 0xa2, 0x30, 0x43, 0x75, 0x4c, 0xf0, 0x06, 0x93, 0x63,
-	0x68, 0xeb, 0x73, 0xc0, 0x22, 0xaf, 0x91, 0xfb, 0xac, 0xe1, 0xe7, 0x88, 0xbe, 0x83, 0x71, 0x3e,
-	0x9e, 0x75, 0x41, 0xdd, 0xc0, 0x39, 0xb8, 0xdc, 0x42, 0x3b, 0xda, 0xbe, 0x69, 0x7d, 0x13, 0xb3,
-	0xb9, 0xa6, 0x6f, 0x80, 0x54, 0xf3, 0xff, 0x79, 0xc0, 0xf4, 0x1e, 0xc6, 0x0b, 0x1e, 0x55, 0x8a,
-	0xef, 0x6e, 0xf8, 0x04, 0xdc, 0x04, 0x57, 0x41, 0xa1, 0xe9, 0x76, 0x82, 0xab, 0x4f, 0xba, 0xef,
-	0x53, 0xe8, 0xe9, 0xab, 0x4a, 0xef, 0xdd, 0x04, 0x57, 0x0b, 0x4b, 0xd1, 0x2b, 0x20, 0xd5, 0x42,
-	0xfb, 0x3c, 0x38, 0x87, 0x71, 0x6e, 0xda, 0xde, 0x6f, 0xd3, 0xea, 0xd5, 0xd0, 0x7d, 0xea, 0x3d,
-	0x80, 0x2f, 0x28, 0x24, 0x4b, 0x13, 0x1f, 0x9f, 0xe8, 0x6b, 0xe8, 0x6e, 0x90, 0xe4, 0xf9, 0x9b,
-	0x14, 0xdf, 0x51, 0xd8, 0x32, 0x16, 0x91, 0x11, 0xe8, 0xd7, 0x6c, 0xda, 0x6f, 0xfa, 0xfa, 0x78,
-	0xfd, 0xd3, 0x01, 0xe7, 0x06, 0x9f, 0xc9, 0x5b, 0xe8, 0x15, 0x97, 0x9c, 0x1c, 0xe6, 0x9b, 0x5a,
-	0x7e, 0x2f, 0x93, 0xff, 0x76, 0xb0, 0x92, 0xd3, 0x03, 0x9d, 0x5e, 0x5c, 0x50, 0x9b, 0x5e, 0x59,
-	0x6b, 0x9b, 0x5e, 0xdd, 0x64, 0x7a, 0x40, 0xe6, 0x30, 0x28, 0xef, 0x00, 0x39, 0x2a, 0x54, 0x2a,
-	0xcc, 0x6f, 0x72, 0xbc, 0x93, 0x5f, 0x8b, 0x94, 0x2d, 0xb2, 0x22, 0x5b, 0x0b, 0x62, 0x45, 0xb6,
-	0xfd, 0xcc, 0x45, 0xca, 0x4e, 0x58, 0x91, 0x2d, 0x27, 0xad, 0xc8, 0xb6, 0x6d, 0xf4, 0x80, 0x5c,
-	0x01, 0x7c, 0x44, 0x65, 0x0d, 0x21, 0x43, 0x13, 0xf8, 0xc7, 0xac, 0xc9, 0xa8, 0x4c, 0xe8, 0x94,
-	0xbb, 0x96, 0xf9, 0xd9, 0xbe, 0xfc, 0x1d, 0x00, 0x00, 0xff, 0xff, 0x72, 0xb9, 0x88, 0x7f, 0x7d,
-	0x05, 0x00, 0x00,
+	// 625 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x8c, 0x55, 0x4f, 0x4f, 0xdb, 0x4e,
+	0x10, 0x4d, 0x62, 0x48, 0x9c, 0x49, 0x42, 0x92, 0x11, 0x3f, 0x30, 0xf9, 0x5d, 0x60, 0x51, 0x25,
+	0x50, 0x25, 0x10, 0x54, 0x6a, 0x0f, 0x55, 0xe9, 0x01, 0xfa, 0x4f, 0xea, 0x01, 0x59, 0x4a, 0x8f,
+	0xb5, 0x4c, 0x3c, 0x85, 0x95, 0x8c, 0xbd, 0xdd, 0xb5, 0x1b, 0xfa, 0xf1, 0x7a, 0xe8, 0xf7, 0xaa,
+	0x76, 0xbd, 0x09, 0xb6, 0x43, 0x95, 0xde, 0xfc, 0xde, 0xce, 0xbc, 0xd9, 0x79, 0x33, 0x9b, 0xc0,
+	0x20, 0x14, 0xfc, 0x34, 0x14, 0xfc, 0x44, 0xc8, 0x34, 0x4b, 0xd1, 0x09, 0x05, 0x67, 0xbf, 0x9a,
+	0xd0, 0xbe, 0x8c, 0x39, 0x25, 0x19, 0x6e, 0x41, 0x8b, 0x47, 0x5e, 0x73, 0xbf, 0x79, 0xd4, 0xf5,
+	0x5b, 0x3c, 0xc2, 0x1d, 0x68, 0x2b, 0x9a, 0x49, 0xca, 0xbc, 0x96, 0xe1, 0x2c, 0xc2, 0x43, 0x18,
+	0x48, 0x8a, 0xb8, 0xa4, 0x59, 0x16, 0xe4, 0x92, 0x2b, 0xcf, 0xd9, 0x77, 0x8e, 0xba, 0x7e, 0x7f,
+	0x41, 0x4e, 0x25, 0x57, 0x3a, 0x28, 0x93, 0xb9, 0xca, 0x28, 0x0a, 0x04, 0x91, 0x54, 0xde, 0x46,
+	0x11, 0x64, 0xc9, 0x6b, 0xcd, 0xe9, 0x0a, 0x22, 0xbf, 0x89, 0xf9, 0xcc, 0xdb, 0xdc, 0x6f, 0x1e,
+	0xb9, 0xbe, 0x45, 0x88, 0xb0, 0x91, 0x84, 0xf7, 0xe4, 0xb5, 0x4d, 0x5d, 0xf3, 0x8d, 0x7b, 0xe0,
+	0xc6, 0xe9, 0x6d, 0x1a, 0xe4, 0x32, 0xf6, 0x3a, 0x86, 0xef, 0x68, 0x3c, 0x95, 0x31, 0x7b, 0x09,
+	0xc3, 0x4b, 0x49, 0x61, 0x46, 0x45, 0x23, 0x3e, 0x7d, 0xc7, 0x43, 0x68, 0xcf, 0x0c, 0x30, 0xfd,
+	0xf4, 0xce, 0x7b, 0x27, 0xba, 0x6f, 0x7b, 0x6e, 0x8f, 0xd8, 0x57, 0x18, 0x55, 0xf3, 0x94, 0xc0,
+	0x67, 0xb0, 0x15, 0xc6, 0x92, 0xc2, 0xe8, 0x67, 0x40, 0x0f, 0x5c, 0x65, 0xca, 0x08, 0xb8, 0xfe,
+	0xc0, 0xb2, 0xef, 0x0c, 0x59, 0xd2, 0x6f, 0xfd, 0x5d, 0xff, 0x00, 0x86, 0x57, 0x14, 0x53, 0xf9,
+	0x5e, 0x35, 0x8f, 0xd9, 0x29, 0x8c, 0xaa, 0x21, 0x4a, 0xe0, 0xff, 0xd0, 0x4d, 0xd2, 0x2c, 0xf8,
+	0x96, 0xe6, 0x49, 0x64, 0xab, 0xbb, 0x49, 0x9a, 0xbd, 0xd7, 0x98, 0x71, 0x70, 0xaf, 0x43, 0xa5,
+	0xe6, 0xa9, 0x8c, 0x70, 0x1b, 0x36, 0xe9, 0x3e, 0xe4, 0xb1, 0xd5, 0x2b, 0x80, 0x36, 0xef, 0x2e,
+	0x54, 0x77, 0xe6, 0x62, 0x7d, 0xdf, 0x7c, 0xe3, 0x04, 0xdc, 0x5c, 0x91, 0x34, 0xa6, 0x3a, 0x26,
+	0x78, 0x89, 0x71, 0x17, 0x3a, 0xfa, 0x3b, 0xe0, 0x91, 0xb7, 0x51, 0xcc, 0x59, 0xc3, 0x4f, 0x11,
+	0xbb, 0x80, 0x71, 0x61, 0xcf, 0xa2, 0xa0, 0x6e, 0xe0, 0x18, 0x5c, 0x61, 0xa1, 0xb5, 0x76, 0x60,
+	0x5a, 0x5f, 0xc6, 0x2c, 0x8f, 0xd9, 0x6b, 0xc0, 0x7a, 0xfe, 0x3f, 0x1b, 0xcc, 0x6e, 0x61, 0x3c,
+	0x15, 0x51, 0xad, 0xf8, 0xd3, 0x0d, 0xef, 0x81, 0x9b, 0xd0, 0x3c, 0x28, 0x35, 0xdd, 0x49, 0x68,
+	0xfe, 0x51, 0xf7, 0x7d, 0x00, 0x7d, 0x7d, 0x54, 0xeb, 0xbd, 0x97, 0xd0, 0x7c, 0x6a, 0x29, 0x76,
+	0x06, 0x58, 0x2f, 0xb4, 0x6e, 0x06, 0xc7, 0x30, 0x2e, 0x86, 0xb6, 0xf6, 0x6e, 0x5a, 0xbd, 0x1e,
+	0xba, 0x4e, 0x7d, 0x0c, 0xc3, 0xcf, 0x5c, 0x65, 0x25, 0x6d, 0xf6, 0x16, 0x46, 0x55, 0x4a, 0x09,
+	0x7c, 0x0e, 0xdd, 0x85, 0xd3, 0xda, 0x42, 0x67, 0x75, 0x12, 0x8f, 0xe7, 0xac, 0x0f, 0xf0, 0x85,
+	0xa4, 0xe2, 0x69, 0xa2, 0xe5, 0x5e, 0x41, 0x6f, 0x89, 0x94, 0x28, 0xde, 0xb9, 0xfc, 0x41, 0xd2,
+	0x5e, 0xdd, 0x22, 0x1c, 0x81, 0xfe, 0x85, 0x30, 0x96, 0x6e, 0xfa, 0xfa, 0xf3, 0xfc, 0xb7, 0x03,
+	0xce, 0x15, 0x3d, 0xe0, 0x1b, 0xe8, 0x97, 0x1f, 0x0e, 0x6e, 0x17, 0xdb, 0x5f, 0x7d, 0x83, 0x93,
+	0xff, 0x9e, 0x60, 0x95, 0x60, 0x0d, 0x9d, 0x5e, 0x5e, 0x7a, 0x9b, 0x5e, 0x7b, 0x2a, 0x36, 0xbd,
+	0xfe, 0x3a, 0x58, 0x03, 0x2f, 0x61, 0xab, 0xba, 0x57, 0xb8, 0x53, 0xaa, 0x54, 0xf2, 0x6d, 0xb2,
+	0xfb, 0x24, 0xbf, 0x10, 0xa9, 0x8e, 0xdd, 0x8a, 0xac, 0x2c, 0x9d, 0x15, 0x59, 0xdd, 0x91, 0x42,
+	0xa4, 0x3a, 0x5d, 0x2b, 0xb2, 0xb2, 0x1d, 0x56, 0x64, 0x75, 0x15, 0x58, 0x03, 0x2f, 0x60, 0x50,
+	0x1e, 0xae, 0xb2, 0x76, 0xd4, 0x76, 0xc0, 0xda, 0x51, 0x5f, 0x03, 0xd6, 0xc0, 0x33, 0x80, 0x0f,
+	0x94, 0xd9, 0x81, 0xe2, 0xd0, 0x84, 0x3d, 0x0e, 0x7b, 0x32, 0xaa, 0x12, 0x3a, 0xe5, 0xa6, 0x6d,
+	0xfe, 0x00, 0x5e, 0xfc, 0x09, 0x00, 0x00, 0xff, 0xff, 0x34, 0x14, 0x6b, 0x5d, 0x11, 0x06, 0x00,
+	0x00,
 }
diff --git a/api/api.proto b/api/api.proto
index 6f49fb2b6d7cb0772aa9cdbcc33afb6474e92bbd..23842fc875ea8a5e8ae4fc9078c953c347d960ea 100644
--- a/api/api.proto
+++ b/api/api.proto
@@ -80,6 +80,14 @@ message DeletePasswordResp {
   bool not_found = 1;
 }
 
+// ListPasswordReq is a request to enumerate passwords.
+message ListPasswordReq {}
+
+// ListPasswordResp returs a list of passwords.
+message ListPasswordResp {
+  repeated Password passwords = 1;
+}
+
 // VersionReq is a request to fetch version info.
 message VersionReq {}
 
@@ -104,6 +112,8 @@ service Dex {
   rpc UpdatePassword(UpdatePasswordReq) returns (UpdatePasswordResp) {};
   // DeletePassword deletes the password.
   rpc DeletePassword(DeletePasswordReq) returns (DeletePasswordResp) {};
+  // ListPassword lists all password entries.
+  rpc ListPasswords(ListPasswordReq) returns (ListPasswordResp) {};
   // GetVersion returns version information of the server.
   rpc GetVersion(VersionReq) returns (VersionResp) {};
 }
diff --git a/server/api.go b/server/api.go
index 660c5ccc7e038f0399498043e912d6a86d926eb6..491537aeb7bf605c7f5f671a5cb99aa2a854e3f9 100644
--- a/server/api.go
+++ b/server/api.go
@@ -171,3 +171,26 @@ func (d dexAPI) GetVersion(ctx context.Context, req *api.VersionReq) (*api.Versi
 		Api:    apiVersion,
 	}, nil
 }
+
+func (d dexAPI) ListPasswords(ctx context.Context, req *api.ListPasswordReq) (*api.ListPasswordResp, error) {
+	passwordList, err := d.s.ListPasswords()
+	if err != nil {
+		log.Printf("api: failed to list passwords: %v", err)
+		return nil, fmt.Errorf("list passwords: %v", err)
+	}
+
+	var passwords []*api.Password
+	for _, password := range passwordList {
+		p := api.Password{
+			Email:    password.Email,
+			Username: password.Username,
+			UserId:   password.UserID,
+		}
+		passwords = append(passwords, &p)
+	}
+
+	return &api.ListPasswordResp{
+		Passwords: passwords,
+	}, nil
+
+}
diff --git a/storage/conformance/conformance.go b/storage/conformance/conformance.go
index af7ff2b3fd1003d79d1d85ca0f3a3b6873fe13d3..d9cc1ca83031c5d190a0c38944041f300a307696 100644
--- a/storage/conformance/conformance.go
+++ b/storage/conformance/conformance.go
@@ -5,6 +5,7 @@ package conformance
 
 import (
 	"reflect"
+	"sort"
 	"testing"
 	"time"
 
@@ -244,6 +245,12 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 	}
 }
 
+type byEmail []storage.Password
+
+func (n byEmail) Len() int           { return len(n) }
+func (n byEmail) Less(i, j int) bool { return n[i].Email < n[j].Email }
+func (n byEmail) Swap(i, j int)      { n[i], n[j] = n[j], n[i] }
+
 func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	// Use bcrypt.MinCost to keep the tests short.
 	passwordHash, err := bcrypt.GenerateFromPassword([]byte("secret"), bcrypt.MinCost)
@@ -294,6 +301,8 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 			t.Errorf("list password: %v", err)
 			return
 		}
+		sort.Sort(byEmail(want))
+		sort.Sort(byEmail(passwords))
 		if diff := pretty.Compare(want, passwords); diff != "" {
 			t.Errorf("password list retrieved from storage did not match: %s", diff)
 		}