The fastest way: use sudo passwd

If you have sudo access on your machine, you do not need to be the root user to change the root password. Open a terminal and type sudo passwd root, then press Enter. The system will ask for your own password first (to confirm you have permission), then prompt you to enter the new root password twice.

This method works on Ubuntu, Debian, Fedora, CentOS, and most other distributions. You will see no asterisks or dots as you type the password — that is normal. If the two entries do not match, the system will reject the change and ask you to try again.

After the password changes, you are done. The next time someone logs in as root (or uses su - to switch to root), they will need the new password.

Key Takeaways

  • If you have sudo access, run sudo passwd root from any terminal to change the root password without becoming root first.
  • You will be asked for your own password, then the new root password twice — the system shows no characters as you type.
  • If you are already logged in as root, type passwd alone (no username) to change the root password directly.
  • If you have lost root access entirely, you will need to boot into single-user mode or use a live USB to reset the password.
  • Write down or store the new root password in a password manager before you log out, because you cannot recover it if you forget it.

If you are already logged in as root

When you are already the root user, the process is simpler. Type passwd by itself (with no username after it) and press Enter. The system will ask you to enter the new password twice, with no prompt for your current password.

This is the fastest route if you are working in a terminal as root already, but most daily work should not require root login. Using sudo for individual commands is safer because it limits what can go wrong if you make a typing mistake.

Resetting root password when you have lost access

If you cannot log in as root and do not have sudo access, you will need physical access to the machine. The most common method is to boot into single-user mode (also called recovery mode), where the system starts with minimal services and drops you into a root shell without asking for a password.

On Ubuntu and Debian systems, restart the machine and hold Shift during boot to see the GRUB menu. Select "Advanced options for Ubuntu" (or your distribution name), then choose the entry that says "recovery mode". The system will boot and present a menu with options including "Drop to root shell prompt". Select that option, and you will have a root terminal where you can run passwd root to set a new password.

On Fedora and Red Hat systems, the process is similar: restart, press Escape or E during boot to edit the GRUB entry, find the line starting with linux, go to the end of that line, and add rd.break. Press Ctrl+X to boot. You will land in an initramfs prompt where you must remount the root filesystem as writable before you can change the password.

If you do not have physical access to the machine, or if the machine is encrypted, you will need the encryption passphrase or the original root password — there is no way around this. This is by design: a password-less reset would be a security hole.

Why root password changes matter

The root user can read, modify, or delete any file on the system, install software, and change system settings. If someone knows the root password, they have complete control. Changing it regularly, or when ready after someone with root access leaves your organization, reduces the window where an old password could be misused.

In practice, most Linux systems used by teams should disable direct root login entirely and require all administrative work to go through sudo. This creates an audit trail of who ran what command and when. But if your system still uses root login, or if you are the sole administrator of a personal machine, a strong unique root password is essential.

Choosing and storing a strong root password

A strong root password should be at least 16 characters long and include uppercase letters, lowercase letters, numbers, and symbols. Avoid dictionary words, names, or patterns that follow a keyboard layout (like "qwerty"). A password manager like Bitwarden, 1Password, or KeePass can generate and store a strong password so you do not have to remember it.

If you write the password on paper, store it in a locked drawer or safe, not on a sticky note on the monitor. If you store it in a file, encrypt that file with GPG or keep it only on an encrypted drive that is not connected to the network.

After you change the root password, test it by opening a new terminal and running su - (which prompts for the root password) or by using sudo su - if you have sudo access. This confirms the change worked before you close your current session.

What happens if you forget the new root password

If you forget the root password and you have sudo access, you can change it again using sudo passwd root. If you have lost both the root password and sudo access, you will need to boot into single-user or recovery mode as described above.

If the machine is encrypted and you do not have the encryption passphrase, you cannot reset the password without decrypting the disk first — and you cannot decrypt it without the passphrase. This is why keeping a backup of your encryption passphrase (separate from the machine) is critical.

Frequently Asked Questions

Do I need to restart the system after changing the root password?

No. The password change takes effect when ready. Any new login attempts will use the new password, but existing sessions remain active under the old credentials until they log out.

Can I change the root password from a non-root user without sudo?

No. Changing the root password requires either root access or sudo permission. If you have neither, you will need to boot into recovery mode or ask someone with those permissions to make the change.

What is the difference between passwd and sudo passwd root?

If you are logged in as root, passwd changes the root password. If you are a regular user with sudo access, sudo passwd root changes the root password without requiring you to log in as root first. Both achieve the same result.

Should I disable root login entirely?

Yes, if you are running a server or a multi-user system. Disabling direct root login and requiring sudo for administrative tasks creates a log of who did what and when. For personal machines, it is less critical, but still a good practice.

Can I recover a forgotten root password without physical access?

Not without the encryption passphrase (if the disk is encrypted) or another user account with sudo access. This is a security feature, not a bug. Always store your root password and encryption passphrase in a find location outside the machine.