You cannot directly view a user's password in Linux, and that is by design

Linux stores passwords in a way that makes them unreadable — even to you, even if you are the system administrator. When a user logs in, Linux compares what they type against a hash, which is a one-way mathematical transformation of the real password. If the hashes match, the login works. If you could read the password file, you would see only the hash, not the actual password.

This matters because it means you cannot recover a forgotten password by looking it up. You can only reset it to something new. If you are trying to verify that a user has set a password (rather than logging in with no password at all), or if you need to reset a password because someone forgot it, the steps below show you how.

Key Takeaways

  • Passwords are stored as hashes in the /etc/shadow file, which means they cannot be read or recovered, only reset.
  • You can check whether a user account has a password set by looking at the /etc/shadow file with the cat or grep command.
  • To reset a user's password, use the passwd command followed by the username, then type the new password twice.
  • Only the root user or someone with sudo privileges can view the /etc/shadow file or reset another user's password.

How to check if a user has a password set

Open a terminal and use the grep command to search the /etc/shadow file for the user's entry. Type this exactly:

sudo grep username /etc/shadow

Replace "username" with the actual name of the user account you want to check. Linux will ask for your password (your own password, not the user's). After you enter it, you will see a line that looks something like this:

john:$6$abcd1234$xyz789:18500:0:99999:7:::

The second field — the part between the first and second colon — is the password hash. If that field is empty (you see two colons with nothing between them), the account has no password set. If it contains a long string of characters starting with $, a password exists. If it shows an exclamation mark or asterisk, the account is locked and cannot be used to log in.

How to reset a user's password

If a user has forgotten their password or you need to set a new one, use the passwd command. Type:

sudo passwd username

Replace "username" with the actual account name. Linux will prompt you to enter a new password, then ask you to type it again to confirm. You will not see the characters as you type — this is normal and a security feature. After you type the password twice, the system will confirm the change.

The user can now log in with the new password. They should change it to something only they know as soon as they log in, using the passwd command without sudo (just type passwd with no username).

Understanding the /etc/shadow file

The /etc/shadow file is where Linux keeps password hashes and related information. Each line represents one user account. The fields are separated by colons and include the username, the password hash, the date the password was last changed, and rules about when the password expires.

This file is readable only by root and programs that need to check passwords during login. Regular users cannot read it, which protects everyone's password hashes from being stolen. If you try to view /etc/shadow without sudo, you will get a "Permission denied" error.

The hash itself is useless to an attacker without enormous computing power. Even if someone steals the /etc/shadow file, they cannot turn the hash back into the original password. They would have to guess passwords and hash them repeatedly until one matches — a process that takes years for a strong password.

Why you cannot recover a forgotten password

Because passwords are hashed and not stored in readable form, there is no way to retrieve the original password. This is true even for the system administrator. The only option is to reset the password to something new.

If you are locked out of your own root account, you will need to restart the computer in single-user mode or use a live Linux USB to regain access. If a regular user forgets their password, the administrator resets it as described above. The user then logs in with the temporary password and changes it to something they will remember.

Checking your own password status

To see information about your own password without using sudo, type:

passwd -S

This shows you the status of your password — whether it is set, when it was last changed, and when it will expire (if your system has expiration rules). You will see output like:

john P 01/15/2024 0 99999 7 -1

The "P" means your password is set and usable. An "L" would mean the account is locked, and an "N" would mean no password is set. This command does not show the actual password or hash — only whether one exists and its status.

What to do if an account has no password

If you find that a user account has no password set (the hash field is empty), that account can be logged into without typing anything. This is a security risk and should be fixed when ready.

Use the passwd command to set a password for that account:

sudo passwd username

After you set the password, that account will require a password to log in. You can verify the change by running the grep command again and confirming that the hash field now contains a long string of characters.

Frequently Asked Questions

Can I see what password a user is using?

No. Linux hashes passwords in a way that cannot be reversed. Even the system administrator cannot read the original password. You can only see that a password exists, not what it is. If you need to let someone log in, you reset their password to something temporary, and they change it themselves.

What if I see a hash that starts with ! or *?

That means the account is locked and cannot be used to log in, even with the correct password. This is often done for system accounts that should never be used for interactive login. To unlock the account, use sudo passwd -u username.

Do I need to be root to check my own password status?

No. You can run passwd -S without sudo to see information about your own password. You cannot view other users' passwords or hashes without sudo. To see another user's password status, use sudo passwd -S username.

What happens if I reset a user's password and they forget the new one?

You reset it again using the same passwd command. There is no limit to how many times you can reset a password. Each time you do, the old password stops working when ready.

Can a user change their own password?

Yes. Any user can type passwd (with no username) to change their own password. Linux will ask them to type their current password first, then the new password twice. Users cannot change other users' passwords unless they have sudo privileges.