passwd Command in Linux: Change User Passwords

Sooner or later, you will need to change a password on a Linux system: your own as part of good account hygiene, another user’s when they forget theirs, or the root password on a server you have just set up. All of these tasks are handled by the passwd command. The encrypted passwords and aging information are stored in the /etc/shadow file.

As a regular user, you can only change your own password. The root user and users with sudo privileges can change another user’s password and control how the password can be used or changed.

When changing a password, make sure you use a strong and unique password. A strong password has at least 16 characters and contains at least one uppercase letter, one lowercase letter, one number, and one special character.

The instructions in this guide work on any Linux distribution, including Ubuntu, Debian, and Fedora. If you are on Ubuntu and also want the GNOME Settings steps, see how to change a user password in Ubuntu .

passwd Command Syntax #

The basic passwd syntax is:

passwd [OPTIONS] [USERNAME]

Run passwd without a username to change your own password. Run it as root, or with sudo, followed by a username to change another user’s password.

Changing Your Own Password #

To change your own password, run passwd without any arguments:

passwd

You will be prompted to enter your current password. If correct, the command will ask you to enter and confirm the new password:

Changing password for linuxize.
Current password:
New password:
Retype new password:
passwd: password updated successfully

Log in again using the new password.

Changing Another User’s Password #

To change the password of another user account, run the passwd command followed by the username. For example, to change the password of a user named sansa:

sudo passwd sansa

You will be prompted to enter and confirm the new password:

New password:
Retype new password:
passwd: password updated successfully

Unlike changing your own password, you are not asked for the current password.

Changing the Root Password #

To change the root password, run:

sudo passwd root

Enter and confirm the new root password when prompted.

If you do not know the current root password and have sudo access, this is the way to reset it.

Changing a Password Without sudo #

The examples in this guide assume your user can run sudo. On Debian, that is not always true. If you set a root password during installation, the installer does not install sudo and does not add your first user to the sudo group. Running sudo passwd then fails with sudo: command not found. When sudo is installed but your user has no sudo rights, you get sansa is not in the sudoers file. instead.

On these systems, you can use su to run passwd as root. To change the password of the user sansa, run:

su - -c 'passwd sansa'

The first prompt asks for the root password, not your own. The next two prompts set the new password for sansa:

Password:
New password:
Retype new password:
passwd: password updated successfully

To change the root password itself, open a root shell with su - and run passwd without a username.

On a default Ubuntu installation, this approach fails with su: Authentication failure because the root password is locked. It works if you have already enabled the root password. To give your Debian user sudo rights, see how to create a sudo user on Debian . For the other causes of the sudo: command not found error, see how to fix sudo command not found .

Removing a Password (Empty Password) #

To remove a user’s password (set it to empty), use the -d option:

sudo passwd -d sansa

An empty password allows passwordless login, so use this only in controlled environments.

Forcing a Password Change at Next Login #

To force a user to change their password the next time they log in, expire the password with the --expire option:

sudo passwd --expire sansa

The next time the user logs in over SSH, they will see a message requiring them to set a new password:

WARNING: Your password has expired.
You must change your password now and log in again!
Changing password for sansa.
Current password:
New password:
Retype new password:
passwd: password updated successfully
Connection to 192.168.1.10 closed.

The Current password: prompt asks for the expired password. Once the new password is set, SSH closes the connection, and the user logs in again with the new password.

You can also use chage to achieve the same result:

sudo chage -d 0 sansa

Password Aging Policy with chage #

The chage command controls password aging. It allows you to set expiration dates, minimum and maximum password age, and warning periods.

To view the password aging information for a user:

sudo chage -l sansa

Last password change                    : Feb 03, 2026
Password expires                        : never
Password inactive                       : never
Account expires                         : never
Minimum number of days between password change  : 0
Maximum number of days between password change  : 99999
Number of days of warning before password expires : 7

Common chage options:

• Set the maximum number of days a password is valid (e.g., 90 days):

  Terminal

  sudo chage -M 90 sansa

• Set the minimum number of days between password changes (e.g., 7 days):

  Terminal

  sudo chage -m 7 sansa

• Set the number of warning days before the password expires (e.g., 14 days):

  Terminal

  sudo chage -W 14 sansa

• Set an account expiration date:

  Terminal

  sudo chage -E 2026-12-31 sansa

Locking and Unlocking a User Password #

To lock a user’s password and prevent password authentication:

sudo passwd -l sansa

passwd: password changed.

This prepends a ! to the password hash in /etc/shadow, making it invalid. The account remains usable through other authentication methods, such as SSH keys.

To unlock the password:

sudo passwd -u sansa

To check the password status:

sudo passwd -S sansa

The second field shows L for a locked password, NP for no password, or P for a usable password.

To disable new logins to a local account, including SSH key logins, expire the account with usermod. Existing sessions remain active:

sudo usermod --expiredate 1 sansa

To remove this account expiry later, run sudo chage -E -1 sansa. If you also locked the password, unlock it separately with sudo passwd -u sansa.

Quick Reference #

FAQ #

How do I change the root password if I forgot it?
If you have sudo access, run sudo passwd root. If you do not have sudo access, boot into single-user mode or a recovery environment to reset it.

What are the password requirements in Linux?
By default, Linux uses PAM (Pluggable Authentication Modules) to enforce password quality. The default rules depend on the distribution and PAM configuration in /etc/pam.d/. You can install libpam-pwquality (or pam_pwquality on RHEL-based systems) to configure minimum length, character classes, and other requirements.

What is the difference between passwd --expire and chage -d 0?
Both commands force the user to change their password at the next login. passwd --expire is simpler; chage -d 0 sets the “last password change” date to epoch 0, which has the same effect.

Can I change a password non-interactively in a script?
Yes. Pipe the new password to chpasswd:

echo "username:newpassword" | sudo chpasswd

Be careful with this approach: the plain-text password ends up in your shell history. In scripts, read the password from a protected file or a secrets manager instead of hardcoding it.

What does locking a password with passwd -l do?
It prepends ! to the password hash in /etc/shadow, making password authentication impossible. It does not disable SSH key-based login. To disable new logins to a local account, use sudo usermod --expiredate 1 username. Setting the shell to /usr/sbin/nologin only restricts shell access; SSH forwarding and internal SFTP can remain available. Existing sessions are not terminated by password locking or account expiry.

Conclusion #

The passwd command handles password changes for your own account and other users. Use chage to manage password aging policies like expiration and minimum age. To lock or unlock passwords, use passwd -l and passwd -u.

For other account changes such as group membership, login shell, or expiry date, see the usermod command guide.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page