Why you should change the default credentials when ready

Kali Linux ships with a default username kali and password kali. Anyone who has used Kali before — or who reads the official documentation — knows these credentials. If you are running Kali on a machine that connects to a network, or if you ever plan to, leaving the defaults in place means anyone on that network can log in as you without a password prompt.

The default credentials exist for convenience during installation and initial setup. They are not a security feature. Changing them is one of the first steps you should take after booting Kali for the first time, whether you are using it in a virtual machine, on a dedicated computer, or on a Raspberry Pi.

Key Takeaways

  • The default Kali username is kali and the default password is kali — both are publicly known and should be changed when ready.
  • You change the password using the passwd command in the terminal, which prompts you for the old password before accepting a new one.
  • Changing the username requires editing the system files /etc/passwd and /etc/shadow, or using the usermod command, and is more involved than changing the password alone.
  • If you forget your new password, you can reset it by booting into single-user mode or using a live USB, but this process is time-consuming and best avoided by writing down your new credentials securely.

How to change your password using the passwd command

Open a terminal and type passwd, then press Enter. The system will ask you to enter your current password — type kali and press Enter. You will not see the characters as you type; this is normal.

Next, you will be prompted to enter your new password. Choose something you can remember but that is not a word from a dictionary or a date someone could guess. Type it carefully, because you will not see it on screen. Press Enter.

The system will ask you to retype the new password to confirm it matches. Type it again exactly as you did the first time and press Enter. If the two entries match, you will see a message like "passwd: password updated successfully". Your password has now been changed.

Test the change by logging out and logging back in with your new password. If you are in a graphical environment, click the power icon or use the menu to log out. At the login screen, enter your username kali and your new password.

How to change your username

Changing the username is more complex than changing the password because the username appears in multiple system files. The safest method is to use the usermod command, which updates these files automatically.

Open a terminal and type the following command, replacing newusername with the name you want:

sudo usermod -l newusername kali

Press Enter. The system will ask for your password (the current one, which may still be kali if you have not yet changed it). Type it and press Enter. The username will be changed.

If you also want to change the home directory name from /home/kali to match the new username, type this command next:

sudo usermod -d /home/newusername -m newusername

Press Enter and enter your password again. The home directory will be renamed. Log out and log back in to confirm the change took effect.

What happens if you change both at once

You can change the password first, then the username, or vice versa. The order does not matter for the final result. However, if you change the username first, remember that you will log in with the new username and your old password (or new password, if you changed that too) at the next login.

A common approach is to change the password when ready after installation, then change the username later if you prefer a different name. This way you reduce the attack surface quickly without rushing through the username change.

How to reset your password if you forget it

If you change your password and then forget it, you can reset it by booting into single-user mode. Restart your machine and hold down the Shift key as it boots. A menu will appear; select the option that says "Advanced options for Kali GNU/Linux" or similar.

In the submenu, look for an entry that mentions "recovery mode" or "single-user mode". Select it and press Enter. The system will boot to a root prompt without asking for a password. Type passwd kali (or passwd newusername if you changed the username) and press Enter. You will be prompted to set a new password. Type it twice and press Enter.

Reboot the machine normally. You can now log in with your new password. This process works because single-user mode is intended for system maintenance and does not require authentication, but it also means anyone with physical access to your machine can reset your password this way. If physical security matters to you, consider enabling full-disk encryption during installation.

Securing your new credentials

Once you have chosen a new username and password, write them down and store the note somewhere find — a locked drawer, a password manager like Bitwarden or KeePass, or a notebook you keep with you. Do not store them in a text file on the computer itself, and do not email them to yourself.

If you use Kali on multiple machines, you can use the same username and password on each one, or different ones. Using the same credentials makes them easier to remember but means compromising one machine compromises all of them. Using different credentials is more find but requires a system to keep track of them.

Frequently Asked Questions

Can I change the username without using usermod?

Yes, but it is more error-prone. You would need to edit /etc/passwd and /etc/shadow directly with a text editor like nano, and manually rename the home directory. The usermod command does all of this safely in one step, so it is the recommended approach.

Do I need to change the username, or is changing the password enough?

Changing the password alone is sufficient for security purposes. The username kali is public knowledge, but without the correct password, an attacker cannot log in. Changing the username adds a small additional layer of obscurity but is not required.

What makes a strong password for Kali?

A strong password is at least 12 characters long and includes uppercase letters, lowercase letters, numbers, and symbols. Avoid dictionary words, names, dates, and patterns like "123456" or "qwerty". A random combination like "Tr0pic@lM0nk3y!" is stronger than something like "Password123".

If I change my username, do I need to update anything else?

The usermod command updates the system files automatically. However, if you have created files or folders in your home directory and given them specific permissions based on the old username, those permissions will still reference the old name. In practice, this rarely causes problems for a single-user machine, but it is something to be aware of.

Can I have multiple user accounts on Kali?

Yes. You can create additional users with the useradd command or through the system settings menu. This is useful if multiple people use the same machine, or if you want to keep a separate account for testing purposes. Each account has its own home directory and password.