diff --git a/synapse/config/password.py b/synapse/config/password.py
index 058a3a534..00b1ea3df 100644
--- a/synapse/config/password.py
+++ b/synapse/config/password.py
@@ -23,7 +23,7 @@ class PasswordConfig(Config):
     def read_config(self, config):
         password_config = config.get("password_config", {})
         self.password_enabled = password_config.get("enabled", True)
-        self.pepper = password_config.get("pepper", "")
+        self.password_pepper = password_config.get("pepper", "")
 
     def default_config(self, config_dir_path, server_name, **kwargs):
         return """
diff --git a/synapse/handlers/auth.py b/synapse/handlers/auth.py
index be46681c6..e259213a3 100644
--- a/synapse/handlers/auth.py
+++ b/synapse/handlers/auth.py
@@ -750,7 +750,7 @@ class AuthHandler(BaseHandler):
         Returns:
             Hashed password (str).
         """
-        return bcrypt.hashpw(password + self.hs.config.password_config.pepper,
+        return bcrypt.hashpw(password + self.hs.config.password_pepper,
                              bcrypt.gensalt(self.bcrypt_rounds))
 
     def validate_hash(self, password, stored_hash):
@@ -764,7 +764,7 @@ class AuthHandler(BaseHandler):
             Whether self.hash(password) == stored_hash (bool).
         """
         if stored_hash:
-            return bcrypt.hashpw(password + self.hs.config.password_config.pepper,
+            return bcrypt.hashpw(password + self.hs.config.password_pepper,
                                  stored_hash.encode('utf-8')) == stored_hash
         else:
             return False