VMware ESXi and vSphere Cluster Management

Change Linux User Passwords with passwd

Learn how to use passwd to change, inspect, lock, unlock, and remove Linux user passwords safely, including password aging and /etc/shadow.

What the passwd Command Does

passwd is a Linux command for changing local user passwords and managing selected password-account states. It can change your own password, allow an administrator to reset another user's password, display password status, lock or unlock password authentication, and remove a password.

A Linux system does not normally store passwords as readable plaintext. Instead, it stores a password hash: a one-way representation used to verify a password during authentication. The hash and password-aging metadata are maintained in the protected local account database, usually /etc/shadow.

root is the privileged administrative account. sudo lets an authorized user run an individual command with elevated privileges. An ordinary user can normally change only their own password, while root or an appropriately authorized sudo user can manage another account's password.

Prerequisites: You should know basic shell prompts, Linux usernames, and how to run commands with sudo. Password input is hidden by the terminal, so no characters or asterisks appear while you type.

Change the Current User's Password

Run passwd without a username to change the password of the currently logged-in account:

passwd

Depending on the system and authentication policy, the interactive sequence is usually:

Enter the current password when prompted.
Enter the new password.
Enter the new password again to confirm it.

$ passwd
Changing password for alice.
Current password:
New password:
Retype new password:
passwd: password updated successfully

The terminal does not echo password characters while you type. A local PAM policy may check password length, complexity, dictionary words, reuse, or other quality rules. PAM, or Pluggable Authentication Modules, is the Linux framework commonly used to enforce authentication and password policy.

Users normally have permission to change only their own password. If the old password and the two new-password entries do not match, or if the new password violates local policy, the command reports an error and the password is not changed.

Change Another User's Password

An administrator can set a new password for a named local account with this syntax:

sudo passwd USER

For example, an administrator resetting the password for the account john might run:

sudo passwd john

This normally requires root privileges or sudo authorization. An administrator setting another user's password does not need to know that user's current password. The command prompts for the new password and confirmation instead.

Use administrative password commands carefully. Verify the target username before confirming the new password, especially on systems with similarly named accounts. Never place a password directly in a command argument, shell script, or log-producing command.

View Password Status and Aging

Use passwd -S to display a concise password status record for an account:

sudo passwd -S john

A typical record contains these fields in order:

john P 2026-08-10 0 90 14 30

Field position	Meaning	Typical values or units	Interpretation
1	Username	A local login name	The account whose password metadata is being reported.
2	Password status	`P`, `L`, or `NP`	Indicates whether the password is usable, locked, or absent.
3	Last change date	A date	The date on which the password was last changed.
4	Minimum age	Days	How long the user must wait before changing the password again. `0` means there is no waiting period.
5	Maximum age	Days	How long the password remains valid before it expires.
6	Warning period	Days	How many days before expiration the user receives warnings.
7	Inactivity period	Days	The period after password expiration during which the account may become inactive if the password is not changed.

Password aging is the set of rules controlling when a password may be changed, when it expires, when warnings appear, and when inactivity takes effect. Aging values are generally measured in days. The exact display format can vary slightly by Linux distribution, so consult the local passwd manual if additional fields appear.

Common Password Status Markers

P means the account has a usable password.
L means the password is locked.
NP means the account has no password.

Lock and Unlock a Password

To lock a named user's password, use -l:

sudo passwd -l john

Locking prevents password-based authentication using the account's stored password. It does not necessarily disable the entire account. For example, SSH keys, federated identity, console mechanisms, or other authentication methods may still work unless they are separately restricted.

Unlock a previously locked password with -u:

sudo passwd -u john

Unlocking restores use of the stored password hash when the account, authentication service, and other policy rules permit login. Check the result after either operation:

sudo passwd -S john

State	Status marker	Password-based login	Password retained	Security considerations
Usable password	`P`	Normally permitted if other policies allow it	Yes	Protect the password and follow local password policy.
Locked password	`L`	Blocked for password authentication	Yes	Non-password authentication may still provide access.
No password	`NP`	Depends on PAM and the service configuration	No	Blank-password behavior can create serious exposure or be rejected by services.

Remove an Account Password

passwd -d deletes the password for a named account:

sudo passwd -d john

Removing a password is different from locking it. Locking retains the password metadata but prevents password authentication. Deleting the password leaves the account with no password, and the resulting behavior depends on PAM and the target service. Some services reject blank passwords; others may handle them unsafely if their configuration permits it.

Password Data and /etc/shadow

/etc/shadow is a restricted local account database containing password hashes and password-aging fields. It is protected because disclosure of password hashes can help attackers attempt offline password-guessing attacks, and the file also contains sensitive account-policy information.

The output of passwd -S summarizes password state and aging data derived from this account metadata. You generally do not need to read or edit /etc/shadow directly to manage passwords.

Do not casually edit /etc/passwd, /etc/shadow, or related account database files. Use account-management commands such as passwd so file formats, permissions, locking, and policy integration are handled correctly.

Common Password Tasks

Task	Command pattern	Required privilege	Result	Key caution
Change own password	`passwd`	Current user	Changes the logged-in user's password interactively.	Enter the current password when required and provide the new password twice.
Change another user's password	`sudo passwd USER`	Root or authorized sudo user	Sets a new password without requiring the target user's old password.	Confirm the username before accepting the change.
View password status	`sudo passwd -S USER`	Usually root or permitted account access	Displays status and aging information.	Interpret the status marker and aging fields correctly.
Lock password	`sudo passwd -l USER`	Root or authorized sudo user	Blocks password-based authentication while retaining the password.	Other authentication methods may remain available.
Unlock password	`sudo passwd -u USER`	Root or authorized sudo user	Restores the previously stored password for authentication.	Check expiry, account state, and service policy as well.
Delete password	`sudo passwd -d USER`	Root or authorized sudo user	Removes the account password.	Passwordless access may be unsafe or rejected by PAM and services.

Security and Operational Precautions

Use strong, unique passwords and follow organizational password policy.
Keep passwords out of shell history, command arguments, scripts, process listings, and logs. Use the interactive prompt instead.
Verify the intended account before running administrative commands such as sudo passwd USER, sudo passwd -l USER, or sudo passwd -d USER.
Avoid removing passwords from accounts that can be reached through network services.
Remember that changing a password does not automatically fix account expiration, shell restrictions, PAM policy, remote-service settings, or external identity-management problems.
After locking or unlocking an account password, verify the state with passwd -S and check whether non-password authentication must also be restricted.

Troubleshooting passwd Problems

Permission Error When Changing Another User's Password

An ordinary user normally cannot change another user's password. Confirm the target username, then use an authorized sudo-capable account or contact the system administrator:

sudo passwd john

Do not work around the permission error by manually changing protected password files.

The New Password Is Rejected

Read the displayed error. Common causes include a password that is too short, too easy to guess, reused, dictionary-based, or otherwise prohibited by PAM policy. The two new-password entries may also differ. Choose a strong unique password that meets the local requirements and retype it carefully.

The Account Still Cannot Log In After passwd -u

Unlocking a password does not necessarily restore every form of access. Check the password state first:

sudo passwd -S john

Then investigate account expiration, separate disablement mechanisms, the account's login shell, PAM rules, external identity management, and the authentication method being attempted. SSH key access and SSH password access may be governed independently.

Locking the Password Did Not Stop All Access

passwd -l blocks password-based authentication, not necessarily every authentication path. Identify active methods such as SSH keys, federated identity, console access, or service-specific credentials. Apply account-disablement and service-access controls appropriate to the environment.

A Passwordless Account Behaves Unexpectedly

After passwd -d, inspect the status:

sudo passwd -S john

PAM or the target service may disallow blank passwords, or the account may be locked or otherwise restricted. Review the applicable PAM and service configuration. Prefer a locked password or another approved access design unless passwordless access is explicitly required.

Exam-Relevant Notes

passwd without a username changes the current user's password.
sudo passwd USER changes another user's password and normally requires administrative authorization.
An administrator does not need the target user's current password to set a replacement password.
passwd -S USER reports the username, status marker, last change date, minimum age, maximum age, warning period, and inactivity period.
P means usable password, L means locked password, and NP means no password.
passwd -l locks password authentication but is not necessarily a complete account disablement.
passwd -u unlocks the password; it does not automatically resolve account expiry or service restrictions.
passwd -d removes the password and is not equivalent to locking it.
/etc/shadow stores protected password hashes and aging information; use account-management commands rather than editing it directly.

For related account administration, continue with Linux password management with passwd.