---
title: passwd — Password management
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A command for changing and expiring account passwords. Also used to lock service accounts.
tags: program, User and Security Management, passwd
---

**💬 "passwd command"**

passwd **changes passwords** or locks them. Service accounts are managed by blocking login itself.

Using expiration (-e) forces a password change at the next login.

- **Concept**: Sets, changes, or locks account passwords.
- **Running as yourself**: Changes your own password.
- **Running as root**: Changes another account's password.
- **Status (-S)**: Shows whether a password is locked and expiration details.
## Common options

| Option | Description |
| --- | --- |
| -S <user> | Check password status |
| -l / -u | Lock/unlock account password |
| -e | Force a change at next login |
| -d | Delete password (making login impossible) |

## 3 essential command combinations

- `passwd -S myapp` — Check account lock status
- `passwd -l myapp` — Lock a service account
- `passwd -e deploy` — Force a password change at next login for the deployment account
**💬 "Tell me how to validate this in advance on a dev server"**

Here are common situations on live production servers, organized in order.

### Step 1 · Check status

Check whether the account is locked and the last password change date.

```
passwd -S deploy
```

### Step 2 · Change/lock

Change or lock the password as appropriate for its purpose.

```
passwd -l myapp
```

### Step 3 · Verify

Check the status again.

```
passwd -S myapp
```

## In practice, this is how it is used

### 1. Locking a service account

**Situation** — You need to remove login access for a service account.

```
passwd -l myapp && passwd -S myapp
```

**Result** — The status shows L(locked), so login is blocked.

**Point** — Combined with setting the shell to nologin, this blocks access twice.

### 2. Force an initial password change

**Situation** — You give a temporary password to a new employee and force them to change it.

```
passwd deploy && passwd -e deploy
```

**Result** — When they log in with the temporary password, a password change screen appears immediately.

**Point** — Deliver the temporary password through a secure channel and always require a change.

## Things to watch out for

- Never put passwords directly on the command line (they are exposed in shell history).
- For service accounts, use only key authentication and disable password login.
- -d deletes the password and prevents login, but it can be risky depending on the configuration.
## Actual execution screen

This is the result of checking the password status and locking a service account.

![passwd command execution result: password status and lock](https://games.aidebatehub.com/assets/passwd-demo.png)

Live production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/security/passwd.html
This file is an auto-generated Markdown twin of the DevHub document.