Change Linux Passwords Safely with passwd

Get this wrong on someone else's account and you can lock a colleague out mid-shift, so passwd rewards a bit of care. You'll finish able to change a password interactively, check its ageing status and carry out the common admin actions without ever putting a secret in shell history. The examples match the installed passwd from shadow-utils 4.13. Allow five minutes for a normal change, longer if you need to chase a PAM or policy error.

Before you start

• Use an interactive terminal on the machine whose account you're changing. passwd never displays what you type; don't put a password after the command or in a script.
• Know which account you mean. A normal user can only change their own password. An administrator with the right privilege can change another account's.
• Keep a working session open while testing an admin change. A bad password, an account lock or a failed remote login can otherwise leave you shut out.

1. Change your own password

Run:

passwd

For an account that already has a password, enter the current one once, then the new one twice. Nothing is echoed, and the command checks the site's PAM policy before it will accept the new value:

Changing password for alice.
(current) UNIX password:
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

Exact prompts can differ, since passwd uses PAM, normally configured through /etc/pam.d/passwd. A mismatch, a wrong current password or a policy rejection leaves the existing password untouched. Don't just keep retrying: read the error and check whether the account has a minimum change interval.

passwd
printf 'passwd exit status: %s\n' "$?"

• 0 means success.
• 1 means permission was denied.
• 3 means an unexpected failure where nothing was done.
• Other documented statuses cover invalid options or arguments, a missing password file, and a busy password file.

2. Set a password for another account

This changes account state and needs administrator privilege:

sudo passwd alice

Swap in the exact login name. An administrator bypasses the old-password prompt, but the replacement is still entered twice and still subject to the configured password checks.

If the command fails, check the account and local policy rather than trying variants in public logs:

getent passwd alice
sudo passwd --status alice

getent confirms the name resolves through the system's account sources; the status command is read-only and useful both before and after an admin change.

3. Read password ageing status

Inspect one account with:

passwd --status alice

Typical output has seven fields: the login name; P for a usable password, L for locked, or NP for no password; the last-change date; then minimum age, maximum age, warning period and inactivity period in days. The date and numbers describe policy, not the password itself.

To inspect every account at once:

sudo passwd --all --status

4. Force a change or adjust ageing

To make a user choose a new password at next login:

sudo passwd --expire alice

That changes account state, so confirm it:

sudo passwd --status alice

Ageing values can be set explicitly too. This example permits a change at any time, allows 90 days of validity and warns for the preceding 14 days:

sudo passwd --mindays 0 --maxdays 90 --warndays 14 alice

Use these numbers only when they match the site's policy. Passing -1 to --maxdays removes password-validity checking entirely, which weakens the account. --inactive sets how many days an expired password can sit before the account is locked out of signing in.

5. Recover from a password lock

Locking is not a routine way to disable an account. It modifies the stored password marker and blocks password changes by that user, but it does not necessarily stop SSH keys or another authentication token:

sudo passwd --lock alice
sudo passwd --status alice

sudo passwd --unlock alice
sudo passwd --status alice

Unlocking restores the password saved before the lock; it does not create a new one. If the real goal is disabling the account rather than just the password, use your system's account-management procedure instead: the passwd manpage specifically points administrators at usermod --expiredate 1 for that.

Deleting a password is more dangerous still:

sudo passwd --delete alice

Common traps

• "Authentication token manipulation error": check the account is writable, the filesystem isn't read-only, and the PAM configuration is valid.
• Unexpected policy rejection: complexity and ageing rules are site-specific. Check the PAM stack and the account's status rather than guessing what the policy should be.
• Network accounts: NIS or another remote account source may require the change to happen against the correct server.
• Wrong target: always run passwd --status LOGIN before an admin change, and quote unusual login names when the shell could misread a character.

The underlying data lives in /etc/passwd and /etc/shadow, the latter holding protected account information. Avoid hand-editing either file for a password change; let passwd apply PAM and the system's storage rules for you.