How to Change the Root Password in Ubuntu

To change the root password in Ubuntu, run sudo passwd root from an administrator account. Ubuntu disables direct root password login by default, so setting a password also enables password-based use of the root account unless another security control blocks it.

Most Ubuntu users do not need a separate root password. The safer default is to run administrative commands with sudo and your own password. This guide explains both approaches, along with recovery mode and SSH security.

How Ubuntu handles the root account

Ubuntu creates the root account but gives it a password hash that cannot be used for direct login. The first installer-created administrator normally belongs to the sudo group and can run privileged commands with their own password.

For a temporary root shell, use:

sudo -i

Exit the root shell as soon as the administrative work is finished:

exit

Using sudo provides better accountability and reduces the time you spend in an unrestricted root shell.

Change or set the Ubuntu root password

Sign in with a sudo-enabled account and run:

sudo passwd root

Ubuntu first asks for your own sudo password. It then asks you to enter and repeat the new root password. Password characters are not displayed while you type; this is normal.

A successful result looks similar to:

passwd: password updated successfully

Choose a unique, long password and store it in an approved password manager. Do not reuse a website or email password.

Test the root password locally

su - root

Enter the new root password. Confirm the identity:

whoami
id

Then leave the root shell with exit. A successful local su test does not mean remote SSH root login is enabled.

Change a normal user’s Ubuntu password

Change your own password:

passwd

An administrator can change another local user’s password:

sudo passwd username

This is different from changing the root password. Replace username with the real account name.

Check whether the root password is locked

sudo passwd --status root

The status output includes the account name and password state. Depending on the tools and locale, L normally means locked and P means a usable password is set.

You can also inspect account aging information:

sudo chage -l root

Disable the root password again

Return Ubuntu to its normal locked-root model:

sudo passwd -l root

Confirm the result:

sudo passwd --status root

Locking the password prevents password authentication for that account. It does not automatically remove SSH authorized keys or terminate an existing session. Review /root/.ssh/authorized_keys, SSH rules, and active sessions if you are responding to a security problem.

Reset a forgotten user password with Ubuntu recovery mode

Use recovery mode only on a machine you own or administer. Anyone with unrestricted console access may be able to obtain powerful recovery access unless full-disk encryption and boot security are configured.

1. Reboot the machine and open the GRUB menu. Holding Shift on some BIOS systems or pressing Esc repeatedly on many UEFI systems may display it.
2. Select Advanced options for Ubuntu.
3. Select a kernel entry marked (recovery mode).
4. Choose the root shell option from the recovery menu.
5. Remount the root filesystem read-write.

mount -o remount,rw /

Reset the required account password:

passwd username

For the root account specifically:

passwd root

After a successful update, flush pending disk writes and reboot:

sync
reboot

If the root filesystem is encrypted, recovery still requires the disk-unlock secret. Cloud virtual machines often provide a serial console, rescue environment, or disk-repair workflow instead of an interactive GRUB screen.

Reset a password from an Ubuntu live environment

When recovery mode is unavailable, an administrator can boot trusted Ubuntu installation media, mount the installed root filesystem, and use chroot. The correct device depends on the machine’s storage layout, encryption, LVM, and RAID configuration.

Identify filesystems carefully:

lsblk -f

A simple unencrypted example is:

sudo mount /dev/nvme0n1p2 /mnt
sudo mount --bind /dev /mnt/dev
sudo mount --bind /proc /mnt/proc
sudo mount --bind /sys /mnt/sys
sudo chroot /mnt
passwd username
exit

Do not copy the example device name blindly. Mounting or modifying the wrong installation can cause data loss. Use the hosting provider’s rescue instructions for a remote server.

Root password and SSH login are separate

Setting a root password does not necessarily allow root to log in over SSH. OpenSSH uses settings such as PermitRootLogin and PasswordAuthentication.

Check the effective SSH configuration:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '

For internet-facing servers, keep direct root SSH login disabled and use a named administrator with keys and sudo. Follow our guides to SSH key authentication, disabling SSH root login, and Linux server hardening.

Common password errors

“Authentication token manipulation error”

The filesystem may be read-only, full, or have a damaged permission or authentication setup. In recovery mode, remount it read-write:

mount -o remount,rw /

Also check available space with df -h and do not manually edit /etc/shadow.

“User is not in the sudoers file”

The current account is not authorised for sudo. Use another approved administrator, recovery mode, or the provider’s console. Do not weaken /etc/sudoers permissions.

The password is rejected immediately

The new value may fail the configured PAM password policy. Choose a longer and less predictable password instead of trying to remove security controls.

su says “Authentication failure”

Check that you are entering the root password rather than your normal user’s password. The root account may still be locked; inspect it with sudo passwd --status root.

SSH root login still fails

This is often intentional. Check effective OpenSSH settings, included configuration files, firewall rules, and authentication logs. Do not enable password-based root SSH merely to bypass a safer administration workflow.

Security checklist after a password change

• Use a unique password stored securely.
• Prefer named sudo users for normal administration.
• Keep direct root SSH login disabled.
• Use SSH keys and protect private keys with a passphrase.
• Review active sessions and authentication logs after suspected compromise.
• Lock the root password again when it is no longer required.

Frequently asked questions

What is the default root password in Ubuntu?

There is no usable default root password. Ubuntu locks direct password login for root and expects administrators to use sudo.

Does sudo passwd change my own password?

sudo passwd root changes root’s password. Plain passwd changes the password of the current user.

Can I administer Ubuntu without enabling root?

Yes. That is the normal design. Use sudo command for individual tasks or sudo -i for a temporary administrative shell.

Does locking root disable SSH keys?

Not necessarily. Password locking and public-key authentication are separate. Review SSH configuration and root’s authorized keys when you need to prevent all remote root access.

Official references

• Ubuntu Server: User management and the root account
• Linux passwd command manual
• Ubuntu Community Help: Password recovery

You now know how to change the root password in Ubuntu, test it locally, recover a forgotten account, and lock root again. Unless a specific application or recovery procedure requires direct root authentication, Ubuntu’s sudo-based default remains the safer everyday choice.