Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · users & permissions

passwd

change a password

passwd sets a new password. Run as yourself it asks for the current one first, then the new one twice. Run as root it can set any account’s password, and lock an account so it cannot log in.

Nothing appears as you type a password. That is deliberate, not a frozen terminal.

Your own
passwd
asks for the old one first
Someone else’s
sudo passwd NAME
root is not asked the old one
Lock
passwd -l NAME
password login refused
Stored in
/etc/shadow
as a hash, never plain text

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashpasswd
$ passwd
Changing password for user.
1Current password:
2New password:
Retype new password:
3passwd: password updated successfully
4$ sudo passwd -S deploy
deploy P 2026-09-30 0 99999 7 -1
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
Prove it is you

The current password is asked so that someone who finds your terminal unlocked cannot change it.

2
The new one, twice

Nothing is echoed, not even stars. Typing it twice guards against a slip that would lock you out.

3
Done

The hash in /etc/shadow has been replaced. Existing sessions stay logged in; the new password applies from the next login.

4
Account status

P means a usable password is set; L would mean locked. Then the date of the last change and the ageing limits in days.

Switches

A switch changes how the command behaves. These are the ones used day to day; man passwd lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-l
Lock the account’s password.
-u
Unlock it.
-e
Expire the password, forcing a change at next login.
-d
Delete the password, leaving the account with none.
-S
Show the account’s password status.
-x DAYS
Set the maximum number of days a password may be used.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo passwd deploy

Sets another user’s password.

sudo passwd -l deploy

Locks the account’s password. -u unlocks it.

sudo passwd -e deploy

Expires the password, forcing a change at next login.

sudo chage -l deploy

Shows when the password was changed and when it expires.

In cybersecurity

Passwords are stored as hashes, and a weak password’s hash can be cracked.

Length beats cleverness

A long passphrase resists guessing far better than a short password with symbols. Use a password manager and never reuse one across systems.

Locking is not disabling

passwd -l blocks password logins only. The user can still get in with an SSH key. To disable an account fully, also expire it with usermod -e 1.

Protect /etc/shadow

It is readable only by root because anyone holding the hashes can attack them offline at full speed.

Filed under

Users & permissions

Read alongside

useraddCreates a new user account: an entry in /etc/passwd, a group, and optionally a home directory.suSwitches to another user account in the current terminal, after asking for that user’s password.