Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

passwd — change or lock a password

6 min Ubuntu 24.04 · shadow 4.13

The passwd command changes your own password; as root it sets, locks and shows the passwords of other users.

Cheat sheet

9 commands Printable version
  • passwd change your own password
  • sudo passwd alice set someone's password, no old one needed
  • sudo passwd -S alice password status
  • sudo passwd -l alice lock password login
  • sudo passwd -u alice unlock
  • sudo passwd -e alice force a change at next login
  • sudo passwd -d alice delete the password (login without one!)
  • sudo passwd -x 90 -w 7 alice max age 90 days, warn 7 days ahead
  • echo 'alice:NewPass-2026' | sudo chpasswd from a script

Overview

passwd changes an account's password. A regular user changes only their own and types the current one first. Root (through sudo) sets anyone's password without the old one:

text 
student@ubuntu:~$ sudo passwd alice
New password:
Retype new password:
passwd: password updated successfully

Password characters aren't shown while you type — no letters, no asterisks. That's expected: type it and press Enter.

The password itself isn't stored anywhere: /etc/shadow holds its hash (on Ubuntu 24.04 the string starts with $y$, the yescrypt algorithm). Only root can read /etc/shadow.

-S shows the password state:

text 
student@ubuntu:~$ sudo passwd -S alice
alice P 2026-10-18 0 99999 7 -1

Fields: name; P — password set, L — locked, NP — no password; date of the last change; min and max age in days; days of warning before expiry; days after expiry until the account is disabled (-1 — not set).

Options

8

chage shows password ages in more detail (chage -l alice). Full list of options — man passwd.

Option What it does Example
-S --status Password status — P set, L locked, NP none; dates and ages. sudo passwd -S alice
-l --lock Lock password login. SSH key login still works. sudo passwd -l alice
-u --unlock Unlock the password. sudo passwd -u alice
-e --expire Force a password change at the next login. sudo passwd -e alice
-d --delete Delete the password — the account is left with an empty one. dangerous sudo passwd -d alice
-x --maxdays days Maximum password age in days. sudo passwd -x 90 alice
-w --warndays days Days of warning before the password expires. sudo passwd -w 7 alice
-a --all With -S — the status of every account's password. sudo passwd -S -a

Nothing found. Try a shorter query.

Recipes

3

A temporary password for a new colleague

bash 
sudo passwd alice          # set a temporary one
sudo passwd -e alice       # a new one is asked for at first login

Block login without deleting the account

bash 
sudo passwd -l alice                  # the password no longer works
sudo usermod -s /usr/sbin/nologin alice   # interactive login closed too
sudo chage -E 0 alice                 # or expire the whole account

passwd -l closes only password login: an SSH key keeps working. To close login completely you also need nologin or chage -E 0.

Passwords for several users at once

bash 
sudo chpasswd <<'EOF'
alice:Temp-Pass-1
bob:Temp-Pass-2
EOF

chpasswd reads name:password pairs. Don't leave such lines in the shell history or in files: they're passwords in plain text.

Troubleshooting

5

passwd: Authentication token manipulation error

passwd couldn't change the password. Causes by frequency: the current password was mistyped; the two entries of the new one didn't match (the line above says Sorry, passwords do not match.); the new password failed the checks — too short, too simple or too close to the old one. If root gets it and the password is clearly fine, check that the root filesystem isn't mounted read-only (findmnt /) and has free space (df -h /).

passwd: password unchanged

The closing line after any such failure. The line above it names the cause.

passwd: You may not view or modify password information

A regular user is trying to see or change someone else's password. Root is needed: sudo passwd -S alice.

The user still logs in after passwd -l

They log in with an SSH key: locking the password doesn't touch keys. Close login with sudo usermod -s /usr/sbin/nologin alice or sudo chage -E 0 alice.

I type the password and nothing appears

That's by design: the password isn't echoed. Type it fully and press Enter; if you lose track, Ctrl+U erases what you've typed.

Danger zone

2

passwd -d opens login without a password

After passwd -d the account has an empty password, and depending on PAM and SSH settings anyone can log in without typing anything. To forbid a password, use passwd -l, not -d.

The root password

sudo passwd root enables password login as root: on Ubuntu it's off by default, and administration goes through sudo. Don't turn it on without a reason.

See also

  • users-groups — users, groups, usermod, userdel.
  • useradd — create a user who then gets a password.
  • chage — password and account ages.
  • sudo — administration without a root password.
  • ssh-keys — log in with a key instead of a password.
  • nologin — forbid interactive login entirely.

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Topics
Loading…