diff --git a/Modules/Setup.stdlib.in b/Modules/Setup.stdlib.in
index 338de84f09e..7422ddb59e3 100644
--- a/Modules/Setup.stdlib.in
+++ b/Modules/Setup.stdlib.in
@@ -98,6 +98,8 @@
 # Modules with some UNIX dependencies
 #
 
+# needs -lcrypt on some systems
+@MODULE__CRYPT_TRUE@_crypt _cryptmodule.c
 @MODULE_FCNTL_TRUE@fcntl fcntlmodule.c
 @MODULE_GRP_TRUE@grp grpmodule.c
 @MODULE_MMAP_TRUE@mmap mmapmodule.c
diff --git a/configure b/configure
index 711b6d2805f..01aa80091cd 100755
--- a/configure
+++ b/configure
@@ -656,6 +656,8 @@ MODULE_NIS_FALSE
 MODULE_NIS_TRUE
 MODULE__DECIMAL_FALSE
 MODULE__DECIMAL_TRUE
+MODULE__CRYPT_FALSE
+MODULE__CRYPT_TRUE
 MODULE__BLAKE2_FALSE
 MODULE__BLAKE2_TRUE
 MODULE__SHA3_FALSE
@@ -784,6 +786,8 @@ HAVE_GETHOSTBYNAME_R
 HAVE_GETHOSTBYNAME_R_3_ARG
 HAVE_GETHOSTBYNAME_R_5_ARG
 HAVE_GETHOSTBYNAME_R_6_ARG
+LIBCRYPT_LIBS
+LIBCRYPT_CFLAGS
 LIBOBJS
 LIBLZMA_LIBS
 LIBLZMA_CFLAGS
@@ -1041,7 +1045,9 @@ ZLIB_LIBS
 BZIP2_CFLAGS
 BZIP2_LIBS
 LIBLZMA_CFLAGS
-LIBLZMA_LIBS'
+LIBLZMA_LIBS
+LIBCRYPT_CFLAGS
+LIBCRYPT_LIBS'
 
 
 # Initialize some variables set by options.
@@ -1831,6 +1837,10 @@ Some influential environment variables:
               C compiler flags for LIBLZMA, overriding pkg-config
   LIBLZMA_LIBS
               linker flags for LIBLZMA, overriding pkg-config
+  LIBCRYPT_CFLAGS
+              C compiler flags for LIBCRYPT, overriding pkg-config
+  LIBCRYPT_LIBS
+              linker flags for LIBCRYPT, overriding pkg-config
 
 Use these variables to override the choices made by `configure' or to help
 it to find libraries and programs with nonstandard names/locations.
@@ -15251,11 +15261,75 @@ fi
 done
 
 
-# We search for both crypt and crypt_r as one or the other may be defined
-# This gets us our -lcrypt in LIBS when required on the target platform.
-# Save/restore LIBS to avoid linking libpython with libcrypt.
-LIBS_SAVE=$LIBS
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing crypt_r" >&5
+
+
+
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBCRYPT" >&5
+$as_echo_n "checking for LIBCRYPT... " >&6; }
+
+if test -n "$LIBCRYPT_CFLAGS"; then
+    pkg_cv_LIBCRYPT_CFLAGS="$LIBCRYPT_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libxcrypt >= 3.1.1\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "libxcrypt >= 3.1.1") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_LIBCRYPT_CFLAGS=`$PKG_CONFIG --cflags "libxcrypt >= 3.1.1" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$LIBCRYPT_LIBS"; then
+    pkg_cv_LIBCRYPT_LIBS="$LIBCRYPT_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libxcrypt >= 3.1.1\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "libxcrypt >= 3.1.1") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_LIBCRYPT_LIBS=`$PKG_CONFIG --libs "libxcrypt >= 3.1.1" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        LIBCRYPT_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libxcrypt >= 3.1.1" 2>&1`
+        else
+	        LIBCRYPT_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libxcrypt >= 3.1.1" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$LIBCRYPT_PKG_ERRORS" >&5
+
+
+  save_CFLAGS=$CFLAGS
+save_CPPFLAGS=$CPPFLAGS
+save_LDFLAGS=$LDFLAGS
+save_LIBS=$LIBS
+
+
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing crypt_r" >&5
 $as_echo_n "checking for library containing crypt_r... " >&6; }
 if ${ac_cv_search_crypt_r+:} false; then :
   $as_echo_n "(cached) " >&6
@@ -15309,12 +15383,37 @@ ac_res=$ac_cv_search_crypt_r
 if test "$ac_res" != no; then :
   test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
+      $as_echo "#define HAVE_CRYPT_R 1" >>confdefs.h
+
+      if test "$ac_cv_search_crypt_r" = "none required"; then
+        LIBCRYPT_LIBS=
+      else
+        LIBCRYPT_LIBS="$ac_cv_search_crypt_r"
+      fi
+
 fi
 
-LIBS="$LIBS_SAVE"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing crypt" >&5
-$as_echo_n "checking for library containing crypt... " >&6; }
-if ${ac_cv_search_crypt+:} false; then :
+
+CFLAGS=$save_CFLAGS
+CPPFLAGS=$save_CPPFLAGS
+LDFLAGS=$save_LDFLAGS
+LIBS=$save_LIBS
+
+
+
+elif test $pkg_failed = untried; then
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+  save_CFLAGS=$CFLAGS
+save_CPPFLAGS=$CPPFLAGS
+save_LDFLAGS=$LDFLAGS
+save_LIBS=$LIBS
+
+
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing crypt_r" >&5
+$as_echo_n "checking for library containing crypt_r... " >&6; }
+if ${ac_cv_search_crypt_r+:} false; then :
   $as_echo_n "(cached) " >&6
 else
   ac_func_search_save_LIBS=$LIBS
@@ -15327,11 +15426,11 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 #ifdef __cplusplus
 extern "C"
 #endif
-char crypt ();
+char crypt_r ();
 int
 main ()
 {
-return crypt ();
+return crypt_r ();
   ;
   return 0;
 }
@@ -15344,59 +15443,112 @@ for ac_lib in '' crypt; do
     LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
   fi
   if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_search_crypt=$ac_res
+  ac_cv_search_crypt_r=$ac_res
 fi
 rm -f core conftest.err conftest.$ac_objext \
     conftest$ac_exeext
-  if ${ac_cv_search_crypt+:} false; then :
+  if ${ac_cv_search_crypt_r+:} false; then :
   break
 fi
 done
-if ${ac_cv_search_crypt+:} false; then :
+if ${ac_cv_search_crypt_r+:} false; then :
 
 else
-  ac_cv_search_crypt=no
+  ac_cv_search_crypt_r=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_crypt" >&5
-$as_echo "$ac_cv_search_crypt" >&6; }
-ac_res=$ac_cv_search_crypt
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_crypt_r" >&5
+$as_echo "$ac_cv_search_crypt_r" >&6; }
+ac_res=$ac_cv_search_crypt_r
 if test "$ac_res" != no; then :
   test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
+      $as_echo "#define HAVE_CRYPT_R 1" >>confdefs.h
+
+      if test "$ac_cv_search_crypt_r" = "none required"; then
+        LIBCRYPT_LIBS=
+      else
+        LIBCRYPT_LIBS="$ac_cv_search_crypt_r"
+      fi
+
 fi
 
 
-ac_fn_c_check_func "$LINENO" "crypt_r" "ac_cv_func_crypt_r"
-if test "x$ac_cv_func_crypt_r" = xyes; then :
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+CFLAGS=$save_CFLAGS
+CPPFLAGS=$save_CPPFLAGS
+LDFLAGS=$save_LDFLAGS
+LIBS=$save_LIBS
+
+
+
+else
+	LIBCRYPT_CFLAGS=$pkg_cv_LIBCRYPT_CFLAGS
+	LIBCRYPT_LIBS=$pkg_cv_LIBCRYPT_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+  $as_echo "#define HAVE_CRYPT_R 1" >>confdefs.h
+
+
+fi
+
+save_CFLAGS=$CFLAGS
+save_CPPFLAGS=$CPPFLAGS
+save_LDFLAGS=$LDFLAGS
+save_LIBS=$LIBS
+
+
+  CPPFLAGS="$LIBCRYPT_CFLAGS $CFLAGS"
+  LDFLAGS="$LIBCRYPT_LIBS $LDFLAGS"
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for crypt or crypt_r" >&5
+$as_echo_n "checking for crypt or crypt_r... " >&6; }
+if ${ac_cv_crypt_crypt+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+
+    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
-#include <crypt.h>
+        #ifdef HAVE_CRYPT_H
+          #include <crypt.h>
+        #endif
+        #include <unistd.h>
 
 int
 main ()
 {
 
-struct crypt_data d;
-char *r = crypt_r("", "", &d);
+        #ifdef HAVE_CRYPT_R
+          void *x = crypt_r;
+        #else
+          void *x = crypt;
+        #endif
 
   ;
   return 0;
 }
+
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-
-$as_echo "#define HAVE_CRYPT_R 1" >>confdefs.h
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_crypt_crypt=yes
+else
+  ac_cv_crypt_crypt=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
 
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_crypt_crypt" >&5
+$as_echo "$ac_cv_crypt_crypt" >&6; }
+
+CFLAGS=$save_CFLAGS
+CPPFLAGS=$save_CPPFLAGS
+LDFLAGS=$save_LDFLAGS
+LIBS=$save_LIBS
 
-fi
 
-LIBS=$LIBS_SAVE
 
 for ac_func in clock_gettime
 do :
@@ -21381,6 +21533,42 @@ $as_echo "$py_cv_module__blake2" >&6; }
 
 
 
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for stdlib extension module _crypt" >&5
+$as_echo_n "checking for stdlib extension module _crypt... " >&6; }
+      case $py_stdlib_not_available in #(
+  *_crypt*) :
+    py_cv_module__crypt=n/a ;; #(
+  *) :
+    if true; then :
+  if test "$ac_cv_crypt_crypt" = yes; then :
+  py_cv_module__crypt=yes
+else
+  py_cv_module__crypt=missing
+fi
+else
+  py_cv_module__crypt=disabled
+fi
+   ;;
+esac
+  as_fn_append MODULE_BLOCK "MODULE__CRYPT=$py_cv_module__crypt$as_nl"
+  if test "x$py_cv_module__crypt" = xyes; then :
+
+    as_fn_append MODULE_BLOCK "MODULE__CRYPT_CFLAGS=$LIBCRYPT_CFLAGS$as_nl"
+    as_fn_append MODULE_BLOCK "MODULE__CRYPT_LDFLAGS=$LIBCRYPT_LIBS$as_nl"
+
+fi
+   if test "$py_cv_module__crypt" = yes; then
+  MODULE__CRYPT_TRUE=
+  MODULE__CRYPT_FALSE='#'
+else
+  MODULE__CRYPT_TRUE='#'
+  MODULE__CRYPT_FALSE=
+fi
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $py_cv_module__crypt" >&5
+$as_echo "$py_cv_module__crypt" >&6; }
+
+
   { $as_echo "$as_me:${as_lineno-$LINENO}: checking for stdlib extension module _decimal" >&5
 $as_echo_n "checking for stdlib extension module _decimal... " >&6; }
       case $py_stdlib_not_available in #(
@@ -22261,6 +22449,10 @@ if test -z "${MODULE__BLAKE2_TRUE}" && test -z "${MODULE__BLAKE2_FALSE}"; then
   as_fn_error $? "conditional \"MODULE__BLAKE2\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
+if test -z "${MODULE__CRYPT_TRUE}" && test -z "${MODULE__CRYPT_FALSE}"; then
+  as_fn_error $? "conditional \"MODULE__CRYPT\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
 if test -z "${MODULE__DECIMAL_TRUE}" && test -z "${MODULE__DECIMAL_FALSE}"; then
   as_fn_error $? "conditional \"MODULE__DECIMAL\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
diff --git a/configure.ac b/configure.ac
index e539d3bb87d..0008e8a746c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4190,25 +4190,46 @@ AC_CHECK_FUNCS(setpgrp,
     [])
 )
 
-# We search for both crypt and crypt_r as one or the other may be defined
-# This gets us our -lcrypt in LIBS when required on the target platform.
-# Save/restore LIBS to avoid linking libpython with libcrypt.
-LIBS_SAVE=$LIBS
-AC_SEARCH_LIBS(crypt_r, crypt)
-LIBS="$LIBS_SAVE"
-AC_SEARCH_LIBS(crypt, crypt)
+dnl We search for both crypt and crypt_r as one or the other may be defined
+dnl libxcrypt provides <crypt.h> and libcrypt with crypt_r() since
+dnl at least 3.1.1 from 2015.
+dnl FreeBSD defines crypt_r() in <unistd.h>
+AH_TEMPLATE([HAVE_CRYPT_R], [Define if you have the crypt_r() function.])
 
-AC_CHECK_FUNC(crypt_r,
-  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
-#include <crypt.h>
-]], [[
-struct crypt_data d;
-char *r = crypt_r("", "", &d);
-]])],
-    [AC_DEFINE(HAVE_CRYPT_R, 1, [Define if you have the crypt_r() function.])],
-    [])
-)
-LIBS=$LIBS_SAVE
+PKG_CHECK_MODULES([LIBCRYPT], [libxcrypt >= 3.1.1], [
+  AC_DEFINE([HAVE_CRYPT_R], [1])
+], [
+  WITH_SAVE_ENV([
+    AC_SEARCH_LIBS([crypt_r], [crypt], [
+      AC_DEFINE([HAVE_CRYPT_R], [1])
+      if test "$ac_cv_search_crypt_r" = "none required"; then
+        LIBCRYPT_LIBS=
+      else
+        LIBCRYPT_LIBS="$ac_cv_search_crypt_r"
+      fi
+    ])
+  ])
+])
+
+WITH_SAVE_ENV([
+  CPPFLAGS="$LIBCRYPT_CFLAGS $CFLAGS"
+  LDFLAGS="$LIBCRYPT_LIBS $LDFLAGS"
+  AC_CACHE_CHECK([for crypt or crypt_r], [ac_cv_crypt_crypt], [
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([
+        #ifdef HAVE_CRYPT_H
+          #include <crypt.h>
+        #endif
+        #include <unistd.h>
+      ], [
+        #ifdef HAVE_CRYPT_R
+          void *x = crypt_r;
+        #else
+          void *x = crypt;
+        #endif
+      ])
+    ], [ac_cv_crypt_crypt=yes], [ac_cv_crypt_crypt=no])
+  ])
+])
 
 AC_CHECK_FUNCS(clock_gettime, [], [
     AC_CHECK_LIB(rt, clock_gettime, [
@@ -6202,6 +6223,9 @@ PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes])
 PY_STDLIB_MOD([_sha3], [test "$with_builtin_sha3" = yes])
 PY_STDLIB_MOD([_blake2], [test "$with_builtin_blake2" = yes])
 
+PY_STDLIB_MOD([_crypt],
+  [], [test "$ac_cv_crypt_crypt" = yes],
+  [$LIBCRYPT_CFLAGS], [$LIBCRYPT_LIBS])
 PY_STDLIB_MOD([_decimal], [], [], [$LIBMPDEC_CFLAGS], [$LIBMPDEC_LDFLAGS])
 PY_STDLIB_MOD([nis],
   [], [test "$have_nis" = yes -a "$ac_cv_header_rpc_rpc_h" = yes],
diff --git a/setup.py b/setup.py
index 304168a657c..721103e7fce 100644
--- a/setup.py
+++ b/setup.py
@@ -1241,20 +1241,7 @@ class PyBuildExt(build_ext):
             self.missing.append('_curses_panel')
 
     def detect_crypt(self):
-        # crypt module.
-        if VXWORKS:
-            # bpo-31904: crypt() function is not provided by VxWorks.
-            # DES_crypt() OpenSSL provides is too weak to implement
-            # the encryption.
-            self.missing.append('_crypt')
-            return
-
-        if self.compiler.find_library_file(self.lib_dirs, 'crypt'):
-            libs = ['crypt']
-        else:
-            libs = []
-
-        self.add(Extension('_crypt', ['_cryptmodule.c'], libraries=libs))
+         self.addext(Extension('_crypt', ['_cryptmodule.c']))
 
     def detect_dbm_gdbm(self):
         # Modules that provide persistent dictionary-like semantics.  You will