diff --git a/cmd/fleetctl/setup.go b/cmd/fleetctl/setup.go
index 403e833699..5bd38c7ace 100644
--- a/cmd/fleetctl/setup.go
+++ b/cmd/fleetctl/setup.go
@@ -62,6 +62,17 @@ func setupCommand() cli.Command {
 				}
 				fmt.Println()
 				flPassword = string(passBytes)
+
+				fmt.Print("Confirm Password: ")
+				passBytes, err = terminal.ReadPassword(int(os.Stdin.Fd()))
+				if err != nil {
+					return errors.Wrap(err, "error reading password confirmation")
+				}
+				fmt.Println()
+				if flPassword != string(passBytes) {
+					return errors.New("passwords do not match")
+				}
+
 			}
 
 			token, err := fleet.Setup(flEmail, flPassword, flOrgName)