/etc/passwd describes local user accounts in seven colon-separated fields; /etc/shadow holds password-verifier and password-aging data in nine. The key distinction: a marker such as ! blocks Unix-password authentication, but does not by itself prove that every login route is disabled. These formats describe local account files; actual login behavior also depends on the system’s authentication configuration.
What is the difference between /etc/passwd and /etc/shadow?
/etc/passwd maps account names to details such as numeric user and group IDs, home directories, and shells. Programs commonly need to read those details, so the file is generally readable by all users and writable only by the superuser. On a shadow-password setup, its password field usually contains x, indicating that the password verifier is kept in the corresponding /etc/shadow record.
As an Amazon Associate I earn from qualifying purchases.
/etc/shadow contains the password field and password-aging controls. The Linux shadow(5) manual says: “This file must not be readable by regular users if password security is to be maintained.” See the Linux passwd(5) manual and the shadow-utils shadow(5) manual for the documented formats.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat do the seven fields in /etc/passwd mean?
A local account record has this form:
name:password:UID:GID:GECOS:directory:shell
- Login name: The account name used to identify the record.
- Password field: Commonly
xwhen the verifier is stored in/etc/shadow. An empty field may permit passwordless login, although some applications refuse access when it is blank. A leading!locks the password. Values that are not validcrypt(3)results, such as!or*, prevent Unix-password login, but do not necessarily block other login methods. - UID: The numeric user ID. UID
0is the privileged root identity. - GID: The numeric primary group ID. Additional group memberships are recorded elsewhere in the group database.
- GECOS/comment: Informational text, often a person’s name, which tools may display. Utilities that use this field may expand an ampersand to the capitalized login name.
- Home directory: The initial working directory; the login process uses it to set
HOME. - Command interpreter: The login shell or initial program; login uses it to set
SHELL. The cited manual says an empty field defaults to/bin/sh.
What do the nine fields in /etc/shadow mean?
A shadow record has this form:
login:password:last-change:min:max:warning:inactive:expire:reserved
#1 Best Overall
- Login name: Identifies the account and should correspond to an account on the system.
- Password field: An empty value may allow passwordless login, depending on application behavior. A leading
!marks the password as locked; any remaining characters preserve the value that was present before locking. A value that is not a validcrypt(3)result, such as!or*, prevents Unix-password login, though other login methods may still be available. - Last password change: Days since 1970-01-01 00:00:00 UTC. A value of
0requires a password change at the next login. An empty field disables password-aging features. - Minimum password age: Days that must pass before the password can be changed. Empty or
0means there is no minimum wait. - Maximum password age: Days after which a password change is required. When that time elapses, the password may still be accepted and the user is prompted to change it at the next login. An empty field means there is no maximum age, warning period, or inactivity period. If the maximum age is less than the minimum age, the user cannot change the password.
- Warning period: Days before password expiration during which the user is warned. Empty or
0means no warning period. - Inactivity period: Days after password expiration during which the password remains accepted and the user must update it at the next login. After this period elapses, the user cannot log in and must contact an administrator. An empty field means no inactivity period is enforced.
- Account expiration date: Days since 1970-01-01. This controls account expiration, not password age. An empty field means the account never expires. The manual cautions against using
0, because it may be interpreted either as no expiration or as 1970-01-01. - Reserved field: Reserved for future use.
What do x, !, *, and a blank password field mean?
xin/etc/passwd: Commonly means that the password verifier is stored in the matching/etc/shadowrecord.!at the start of a password field: Marks the Unix password as locked. In/etc/shadow, characters after the marker preserve the prior value.*or another non-crypt(3)value: Prevents authentication with a Unix password. It does not establish that all possible access methods are blocked.- Blank password field: Do not assume this means “disabled.” The manuals describe an empty field as potentially permitting passwordless authentication, while noting that applications may reject it.
These markers concern Unix-password authentication, not necessarily every authentication method configured on a host. PAM rules, applications, distribution choices, or centrally managed identity can affect whether and how someone can log in.
How is password expiration different from account expiration?
Password expiration is a password-aging control: after the maximum age, the user may be prompted to change the password at the next login. The inactivity field can set a further period after password expiration, after which login is blocked pending administrator help.
Account expiration is separate: it prevents login for the account. An expired password and an expired account are therefore not interchangeable states. The account-expiration field is expressed as days since 1970-01-01, and the manual warns that 0 can be interpreted inconsistently.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What can go wrong when reading or editing these files?
- Exposing
/etc/shadow: Its protection depends on keeping it unreadable by regular users. The normal documented permission model makes/etc/passwdbroadly readable, but not/etc/shadow. - Assuming a locked password disables the whole account: The marker blocks Unix-password authentication; other configured login paths may remain.
- Confusing an empty field with a lock: Empty password fields can have different consequences from
!or*and should not be treated as a safe disable mechanism. - Changing fields without checking local policy: A mistaken delimiter or value can alter the interpretation of subsequent fields. The file format alone does not reveal PAM behavior, centrally managed identity, or distribution-specific account policy.
The vipw(8) manual documents vipw as the tool for editing /etc/passwd and /etc/shadow. Avoid casual direct edits; follow the account-management documentation for the distribution and identity setup in use. See the vipw(8) manual.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
