Change and Manage Linux User Passwords

Learn how to change, inspect, lock, unlock, and remove Linux user passwords with passwd, including password aging, sudo, and /etc/shadow.

The passwd command changes passwords and manages selected password states for local Linux accounts. It can update your own password, reset another user's password with administrative privileges, display password status, lock or unlock a password, and remove a password.

passwd manages password credentials and related password states; it does not replace broader account-administration tools. Account expiration, login shells, group membership, and service-specific access are separate properties.

On systems using shadow passwords, Linux normally stores a one-way password hash and password-aging metadata in the protected /etc/shadow file. A hash is not the original password. Ordinary users cannot read this file, and it should not be edited manually.

Prerequisites: You should know how to run commands in a terminal, identify Linux usernames, and distinguish an ordinary user from root or an authorized sudo user.

Change Your Own Password

Run passwd without a username argument:

passwd

An ordinary user normally follows this interactive sequence:

Enter the current password when prompted.
Enter the new password.
Enter the new password again for confirmation.

Password input is not displayed in the terminal—not even as asterisks. This is normal. The system may reject a new password if it fails the configured PAM password-quality policy, is too predictable, or violates password-history rules.

Set or Reset Another User's Password

To set the password for a named local account, use:

sudo passwd username

For example:

sudo passwd john

This requires root access or suitable administrative privileges through sudo. An administrator normally does not need to know John's existing password when resetting it; the administrator authenticates to sudo, then supplies and confirms the new password.

Non-root users can normally change only their own passwords. If an ordinary user tries to change another account's password, the command may fail with a permission error. Use an approved administrative account or ask an administrator.

Common passwd Operations

Command	Purpose	Required privileges	Security considerations
`passwd`	Change the current user's password.	Own account access.	Requires the current password in the normal self-service flow and must satisfy local policy.
`passwd username`	Set or reset a named user's password.	`root` or authorized `sudo` access.	Verify the target username before resetting credentials.
`passwd -S username`	Show password status and aging information.	Often usable for the current user; use `sudo` when required by the system.	Status output is account metadata; protect it on sensitive systems.
`passwd -l username`	Lock the user's password.	`root` or authorized `sudo` access.	Blocks password authentication but may not block SSH keys or other authentication methods.
`passwd -u username`	Unlock the user's password.	`root` or authorized `sudo` access.	Restores an existing usable password; it does not create one.
`passwd -d username`	Delete the user's password.	`root` or authorized `sudo` access.	An empty-password account may be dangerous, depending on PAM and service policy.

Inspect Password Status

Use -S with a username:

sudo passwd -S john

A typical result has fields similar to this:

john P 2026-08-01 0 90 14 30

The exact formatting and status letters can vary slightly by distribution and passwd implementation. Interpret the fields by position:

Position	Field	Meaning	Example interpretation
1	Login name	The account being reported.	`john` is the inspected account.
2	Password state	Common indicators are `P` for a usable password, `L` for a locked password, and `NP` for no password.	`P` means a password credential is present and usable for password authentication, subject to other account rules.
3	Last password change	The date on which the password was last changed.	`2026-08-01` is the last-change date in this example.
4	Minimum age	Minimum number of days before the password may be changed again.	`0` permits an immediate password change.
5	Maximum age	Number of days after which the password expires.	`90` means the password is configured to expire after 90 days.
6	Warning period	Number of days before expiration during which warnings are issued.	`14` gives warnings during the final 14 days.
7	Inactivity period	Number of days after expiration before password-based access is considered inactive.	`30` allows 30 days after expiration before inactivity takes effect.

The status and aging information reported by passwd -S corresponds to password and aging metadata maintained on the system, commonly in /etc/shadow. Use dedicated account-aging tools such as chage when you need detailed aging configuration.

Understand Password Aging

Password aging is the set of rules controlling when a password may be changed, when it expires, when warnings appear, and when access becomes inactive.

Last password change: The date the current password was set.
Minimum password age: The minimum number of days that must pass before another change is allowed. A value of zero permits immediate changes.
Maximum password age: The number of days the password remains valid. After this period, the user may be required to change it.
Warning period: The number of days before expiration during which the user receives warnings.
Inactivity period: The number of days after expiration before password-based access is considered inactive or disabled.

These rules do not necessarily disable every possible route into an account. Account expiration, shell restrictions, PAM rules, SSH configuration, and other controls can also affect access.

Lock a Password

Lock a named user's password with -l:

sudo passwd -l john

Password locking marks the password entry as locked and prevents password authentication for that account. It normally preserves the underlying password, so the credential can be restored later.

A password lock is not always the same as disabling the entire account. For example, SSH public-key authentication, an existing session, or another configured authentication method may still work. Restrict those methods separately when the security goal is to block all access.

Unlock a Password

Unlock a user's password with -u:

sudo passwd -u john

This restores use of the existing password credential when one exists. Unlocking does not create a password for an account whose password was absent or unusable. If necessary, set a new password:

sudo passwd john

Remove a Password

Delete a user's password with -d:

sudo passwd -d john

This removes the account password rather than locking it. The result is an account with no password credential. Depending on PAM configuration, console rules, SSH settings, and distribution policy, an empty-password account might be able to authenticate without a password—or might be rejected.

Safety warning: Do not use password deletion as a general method for preventing login. If your goal is to block password access, prefer passwd -l and apply separate account-access controls when necessary.

Locking Versus Deleting a Password

Action	Effect on stored password	Effect on password login	Important caution
`passwd -l username`	Preserves the password and marks it locked.	Blocks password authentication.	Non-password authentication, such as SSH keys, may still work.
`passwd -u username`	Removes the lock from the existing password.	Restores password use if a usable password exists.	It does not create a password or fix account expiration and service restrictions.
`passwd -d username`	Deletes the password credential.	Behavior depends on local authentication policy; empty-password authentication may be possible or prohibited.	Use cautiously and verify PAM, console, SSH, and other service policies.

Relationship to /etc/shadow

/etc/shadow is a protected system file used by shadow-password systems. It contains password hashes and fields used for password aging, rather than readable plain-text passwords. Restricting this file helps prevent users from obtaining password hashes and attempting offline password guessing.

The status and aging values shown by passwd -S reflect this underlying credential and metadata. Use passwd and appropriate account-management tools instead of manually editing /etc/shadow.

Safe Administration Practices

Check the target username carefully before changing, locking, unlocking, or deleting credentials.
Use sudo only through an approved administrative account.
When changing a remote account, keep a separate session open and test the new credentials before closing your known-good session.
Remember that a password operation does not automatically change account expiration, the login shell, SSH key access, or PAM restrictions.
Do not expose passwords, password hashes, or sensitive account output in logs, screenshots, or support requests.

Troubleshooting

Permission denied when changing another user's password

The invoking user is not root and does not have suitable administrative privileges. Run the command through approved sudo access or ask an administrator.

New password rejected

The password may violate the system's PAM quality or password-history policy. Choose a stronger, policy-compliant password and avoid recently used passwords where history enforcement applies.

Account remains inaccessible after unlocking

The account may be expired, have a login shell that prohibits login, be denied by SSH or PAM rules, or have no usable password. Inspect those independent controls and set a password if required.

Locking did not stop all access

Password locking affects password authentication only. Key-based SSH access or another authentication method may remain available. Restrict the additional method and, if required, expire or otherwise disable the account according to local policy.

Removing a password caused unexpected login behavior

Different services can handle empty passwords differently. Avoid deletion as an account-disable method; lock the password and validate the authentication policy for each relevant service.

passwd -S output is confusing

Map each value by position using the status table: username, state, last change, minimum age, maximum age, warning period, and inactivity period. Consult the local passwd manual page because formatting and status letters can vary.

Exam-Relevant Notes

passwd with no username changes the current user's password.
Changing another user's password requires root or suitable sudo privileges and normally does not require the old password.
passwd -S username reports password state and aging fields; P, L, and NP commonly mean usable, locked, and no password.
passwd -l locks a password, passwd -u unlocks an existing password, and passwd -d deletes the password.
Password locking is narrower than disabling an entire account because other authentication methods may remain available.
Password hashes and aging data are normally stored in protected /etc/shadow, not as plain-text passwords.

For related command-line foundations, review Linux fundamentals, how to show the full path of shell commands, and Bash.