passwd sets and changes user passwords. Root can also use it to lock accounts, expire passwords and see password status. Its companion chage controls password ageing.

Change your own password

passwd

You’re asked for the current password, then the new one twice. Nothing is shown while you type. That’s normal.

Change another user’s password (root)

sudo passwd alice

Root isn’t asked for alice’s old password.

Set the root password, for example so the console works in an emergency:

sudo passwd root

Force a change at next login

sudo passwd -e alice        # expire now: alice must choose a new password at next login

That’s useful when creating accounts with a temporary password.

Lock and unlock

sudo passwd -l alice       # lock the password
sudo passwd -u alice       # unlock
sudo passwd -d alice       # delete the password (passwordless login: avoid!)

Locking puts a ! in front of the password hash, so password logins fail. SSH key logins still work. To block an account completely, also expire it or set its shell to nologin:

sudo usermod -e 1 alice

See usermod.

Password status

sudo passwd -S alice
# alice P 2026-10-01 0 99999 7 -1

The fields are the username, the status (P usable password, L locked, NP no password), the date of the last change, the minimum and maximum age in days, the warning period and the inactivity period.

To check every account:

sudo passwd -Sa

Look for unexpected P entries on service accounts and any NP.

Password ageing with chage

sudo chage -l alice                 # show ageing settings
sudo chage -M 90 -W 14 alice        # max 90 days, warn 14 days before
sudo chage -m 1 alice               # at least 1 day between changes
sudo chage -E 2026-12-31 alice      # account expiry date
sudo chage -d 0 alice               # force a change at next login (same as passwd -e)

Defaults for new users are in /etc/login.defs (PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE).

Current guidance (NIST SP 800-63B) actually advises against forced periodic changes for normal users. Long, unique passwords plus MFA work better. Use expiry mainly for temporary accounts and after suspected compromise.

Enforce strong passwords

On Debian and Ubuntu, install the quality checker:

sudo apt install libpam-pwquality

Configure it in /etc/security/pwquality.conf:

minlen = 14
dcredit = 0
ucredit = 0
dictcheck = 1
usercheck = 1
enforce_for_root

Length matters more than character classes. A 14+ character passphrase beats P@ssw0rd1.

Where passwords are stored

  • /etc/passwd holds account information, readable by everyone. The password field just says x.
  • /etc/shadow holds the hashed passwords and ageing data, readable only by root.

Modern systems hash with yescrypt ($y$) or SHA-512 ($6$). Never edit /etc/shadow by hand. Use passwd, chpasswd or usermod.

Set passwords in scripts

echo 'alice:Temp-Password-2026' | sudo chpasswd
sudo passwd -e alice

chpasswd reads user:password lines from stdin. Keep such scripts out of shell history and logs, and force a change afterwards.

Server reality: prefer SSH keys

On internet-facing servers, passwords are the main target of brute-force bots. The safest setup:

  1. Log in with SSH keys only (ssh-keygen).
  2. Disable SSH password authentication (PasswordAuthentication no).
  3. Keep a strong password on your sudo user. sudo still asks for it, which protects against stolen keys being used for root.
  4. Add Fail2Ban as an extra layer.

See Linux server hardening checklist.

Forgot the root or user password?

If you have sudo access as another user, run sudo passwd root. If not, use your provider’s VNC console to boot into recovery or single-user mode and reset it. On VPS.DO the console and OS reinstall are in the control panel.

Quick reference

Task Command
Change own passwd
Change user’s sudo passwd alice
Force change sudo passwd -e alice
Lock / unlock sudo passwd -l / -u
Status sudo passwd -S alice
Ageing info sudo chage -l alice
Account expiry sudo chage -E 2026-12-31 alice
Batch set echo 'u:p' | sudo chpasswd

Related: useradd and Linux groups.

  • Linux
  • Users
  • Security