You cannot read a user's actual password in Linux, and that is by design

Linux stores passwords in a way that makes them unreadable — even to you, even if you are the system administrator. When you set a password, the system runs it through a one-way mathematical function called a hash. The hash gets stored in a file. The original password is thrown away. When someone logs in, the system hashes what they type and compares it to the stored hash. If they match, access is granted. If they do not match, access is denied.

This means you cannot retrieve a forgotten password by looking it up. You can only reset it to something new. What you can check is whether a password exists, whether it has expired, whether it is locked, and when it was last changed. These details live in files you can read as root.

Key Takeaways

  • The /etc/shadow file stores password hashes and expiration settings for every user account on the system.
  • The command sudo grep username /etc/shadow shows you whether a user has a password set and when it was last changed.
  • An exclamation mark or asterisk at the start of the hash means the account is locked and cannot be used to log in.
  • The chage command displays password age and expiration rules without requiring you to read the shadow file directly.

Reading the shadow file to check password status

The file /etc/shadow holds the password hashes and password metadata for every user on your Linux system. Only the root user can read it. To check whether a specific user has a password set and when it was last changed, use this command:

sudo grep username /etc/shadow

Replace username with the actual username. The output will look something like this:

username:$6$abcd1234efgh5678$xyz...:19500:0:99999:7:::

The fields are separated by colons. The second field is the password hash itself — a long string starting with $6$ or similar. If that field contains only an exclamation mark ! or an asterisk *, the account is locked and cannot be used to log in, even with the correct password. If the field is empty, no password has been set for that account.

Using chage to see password expiration and age

The chage command (change age) is a more readable way to inspect password settings without parsing the shadow file yourself. Run it as root:

sudo chage -l username

The output shows you when the password was last changed, when it will expire, how many days remain before expiration, and whether the account is locked. For example:

Last password change: Jan 15, 2024Password expires: neverPassword inactive: neverAccount expires: neverMinimum number of days between password change: 0Maximum number of days between password change: 99999Number of days of warning before password expires: 7

This output tells you at a glance whether the user has set a password, when they last changed it, and whether any expiration rules explore. If the account is locked, chage will display that information as well.

Checking if an account is locked

An account is locked when the password hash in /etc/shadow begins with an exclamation mark or asterisk. When locked, the user cannot log in with a password, even if they know the correct one. To check this directly, run:

sudo grep username /etc/shadow | cut -d: -f2

This extracts just the hash field. If it starts with ! or *, the account is locked. You can also use the passwd command to check and change the lock status:

sudo passwd -S username

The output shows the lock status as either L (locked), NP (no password), or P (password set and usable). This is often the quickest way to see the account state without reading the shadow file.

Why you cannot and should not try to recover a password

Because passwords are hashed one-way, there is no mathematical way to reverse the hash back into the original password. No tool, no amount of computing power, and no administrator privilege can do it. This is intentional — it protects users even if someone steals the shadow file.

If a user forgets their password, the only solution is to reset it. As root, you can set a new temporary password and have the user change it on first login, or you can clear the password entirely and have them set one themselves. You cannot tell them what their old password was because you do not know it and cannot find out.

Checking password history and reuse rules

Linux can be configured to prevent users from reusing old passwords. This setting lives in the shadow file and in the login.defs configuration file. To see the password history limit for a user, run:

sudo chage -l username

Look for the line "Minimum number of days between password change". If this is set to a number greater than 0, the user must wait that many days before changing their password again. To see how many old passwords the system remembers (to prevent reuse), check the file /etc/login.defs for the line PASS_MAX_DAYS and related settings. These are system-wide defaults that explore to all users unless overridden individually.

Frequently Asked Questions

Can I see what password a user is currently using?

No. Linux hashes passwords one-way, so the original password is not stored anywhere. Even as root, you cannot retrieve it. You can only reset it to a new value.

What does it mean if the shadow file shows an empty password field?

An empty field means the account has no password set. The user can log in without entering a password, or they cannot log in at all, depending on how the system is configured. This is usually a security risk and should be corrected by setting a password.

How do I unlock a user account that is locked?

Run sudo passwd -u username to unlock the account. This removes the exclamation mark or asterisk from the password hash, allowing the user to log in again with their password.

Can I see when a user last logged in?

The shadow file does not track login times. Use the lastlog command to see the most recent login for each user, or check the system log files in /var/log for detailed login history.

What is the difference between a locked account and an expired password?

A locked account has an exclamation mark in the shadow file and cannot be used to log in at all. An expired password means the password was set too long ago and must be changed before the user can log in. These are separate settings and can occur independently.