How to Change or Reset the Root Password on Ubuntu 🔐

Changing or resetting the root password in Ubuntu is one of those basic administrative tasks every user should know how to perform. The root account is locked by Ubuntu by default, and sudo is used for actions requiring privileged access — which often confuses the root password and its necessity. Ubuntu does not have a default root password. The root account exists on every install, Desktop and Server alike, but it's locked, and you do admin work with sudo and your own password. If you really need direct root login, you can set a root password yourself.

This walkthrough covers how to change the root password, how to reset it if forgotten, what makes the root account different from a regular sudo user, recovery mode procedures, security best practices, and troubleshooting. If you're new to the OS and want a quick overview of its structure, refer to What is Ubuntu for a clear introduction.

🖥️ Understanding Root User vs Sudo User on Ubuntu

Understanding the difference between the root user and a sudo user helps you manage Ubuntu securely and avoid accidental system-wide changes. Ubuntu disables the root account by default and encourages administrative tasks through sudo, which adds an extra layer of safety. Knowing how each account works ensures you choose the right method when changing or resetting passwords.

Feature	Root User	Sudo User
Default status in Ubuntu	Disabled by default	Enabled when created during installation
Privileges	Full, unrestricted system access — all the time	Temporary administrative access via sudo — per command or session
Password used	Root's own password (locked by default)	The user's own password
Audit trail	Everything logged as "root"	Commands tied to a named user
Security level	High risk if misused	Safer due to controlled privilege elevation
Recommended usage	Advanced administration and recovery only	Everyday administrative tasks

🔐 Does Ubuntu Have a Default Root Password?

No. Ubuntu's server documentation on user management confirms the root account is disabled by default on all Ubuntu installations, but it isn't deleted. Root gets a password hash that matches no possible value, so password login always fails. The same applies to any "default su password" or "default Ubuntu admin password" — the admin password is the one you created for the first user during installation. Cloud and VPS images usually work the same way: you log in as a regular user with an SSH key and use sudo.

Why Ubuntu uses sudo instead of root login

With sudo, each admin authenticates with their own password, every privileged command is logged under a real username, and nobody has to share a root password. You also keep normal user rights until you explicitly ask for more — least privilege in practice.

🔑 How to Set or Change the Root Password

From a sudo-capable account, run:

sudo passwd root

Enter your own password for sudo, then type the new root password twice. Ubuntu's docs show the shorter sudo passwd, which does the same thing because passwd run as root defaults to the root account. Run the command again to change an existing root password.

If you only need a root shell for a few minutes, skip the password entirely:

sudo -i

You get a root login shell using your own credentials, and root stays locked.

Verify the password status

sudo passwd -S root

Check the second field of the output. L means the password is locked, P means it's usable, and NP means there's no password at all.

👤 How to Change a User or Sudo Password

Most people searching "change sudo password" or "change Ubuntu login password" want to change their own account's password, not root's. Run passwd with no arguments:

passwd

It asks for your current password, then the new one. Your sudo password is your login password, so this changes both. To reset another user's password — for a colleague who's locked out, for example — run:

sudo passwd username

You won't be asked for their old password. If you're unsure of the exact username, getent passwd or ls /home lists the accounts on the system.

🔄 How to Reset the Root Password in Recovery Mode

If nobody can log in with sudo, use recovery mode. You need console access — either a physical keyboard or your VPS provider's VNC or web console.

1. Reboot the machine. On BIOS systems, hold Shift as soon as the firmware screen finishes. On UEFI systems, press Esc repeatedly, as the Ubuntu wiki on recovery mode also describes. If you see the Ubuntu logo, you've missed the window — reboot and try again.
2. In the GRUB menu, choose "Advanced options for Ubuntu," then the kernel entry that ends in "(recovery mode)."
3. In the recovery menu, select "root: Drop to root shell prompt."
4. Remount the root filesystem as writable, because it boots read-only:

   mount -o rw,remount /

5. Set the new password, then reboot:

   passwd root
   reboot

To recover a regular account instead, run passwd username at step 5.

When the process looks different

Full-disk encryption adds a passphrase prompt before the recovery menu, and without that passphrase you can't reach the filesystem. Fast boot or a GRUB timeout of zero can hide the menu — turn off fast boot in the firmware settings if Esc and Shift do nothing. If root already has a password, the recovery shell may ask for it. In that case, press e on the GRUB entry, add init=/bin/bash to the end of the line starting with linux, boot with Ctrl+X, then remount and run passwd as above.

🔒 How to Re-lock the Root Account

sudo passwd -l root

This puts a ! in front of root's password hash, so password logins stop working while sudo -i keeps working. Re-lock root as soon as troubleshooting is done — a root password you don't need is one more thing an attacker can brute-force over SSH or at the console. Locking is safer than deleting the password with passwd -d root, which can leave root with no password at all.

📂 How Ubuntu Stores Passwords in /etc/shadow

The /etc/passwd file is readable by everyone, so it doesn't hold real passwords. Its password field contains x, meaning "look in the shadow file." The hashed passwords are in /etc/shadow, which only root can read (see the passwd(5) manpage). To inspect root's entry without opening the whole file:

sudo grep '^root:' /etc/shadow

A password field of ! or *, or a hash that starts with !, means password login is locked. That's why root looks "disabled" even though the account is fully there.

🛡️ Security Best Practices for Root Password Management

Managing the root password responsibly is critical for protecting your Ubuntu system from unauthorized access. Since the root account has unrestricted control, even a single weak password can expose the entire system. Following proper security practices keeps your installation safe, stable, and compliant.

• Use a strong password with uppercase, lowercase, numbers, and symbols.
• Avoid sharing the root password; create individual sudo accounts instead.
• Disable root login if not needed, and rely on sudo for administrative actions.
• Change the password regularly, especially after any security incident.
• Enable two-factor authentication for SSH or remote logins where possible.
• Keep your system updated to patch vulnerabilities that could expose root access.
• Monitor system logs for unauthorized login attempts or privilege escalations.

For broader password-management methods across different distributions, refer to How to Change Linux Password. If you need to verify existing accounts before resetting any password, use the steps in list users and groups on Ubuntu.

🌐 Securing Root Access on SSH and Remote Servers

On a VPS, the root password matters most over SSH. Open /etc/ssh/sshd_config and set one of these:

PermitRootLogin no
# or allow key-only root login:
PermitRootLogin prohibit-password

Then restart the service with sudo systemctl restart ssh. Keep your current session open and test a new login before you disconnect.

For remote servers, SSH keys plus a separate sudo account for every admin — with no shared root credentials — is the safest setup. Add MFA on SSH where supported, install security updates regularly, and if a root password has to exist, make it long and unique.

⚙️ Troubleshooting Common Issues

Even with the right commands, errors can appear when changing or resetting the root password in Ubuntu. They usually stem from permission issues, read-only filesystems, or misconfigured sudo privileges. The table below covers the most common ones and how to fix them quickly.

Symptom	Likely cause	Fix
"Authentication token manipulation error"	Filesystem mounted read-only in recovery	Run mount -o rw,remount /, then passwd
"Read-only file system"	Remount step skipped	Same remount command before running passwd
"Permission denied" / "user is not in the sudoers file"	Account not in the sudo group	In recovery: usermod -aG sudo username
"Command not found"	Typo or missing passwd package	Run sudo apt install passwd to reinstall
Password unchanged	Did not confirm correctly	Repeat sudo passwd root and ensure both entries match
GRUB menu doesn't appear	Wrong key for BIOS/UEFI, or fast boot enabled	Try Esc on UEFI, Shift on BIOS, or disable fast boot
su rejects your password	Root is locked; su wants root's password	Use sudo -i, or set a root password
Root SSH login fails after reset	PermitRootLogin blocks it	Log in as a sudo user instead

If problems persist, refer to guides like Enable Root Account in Ubuntu or Change User Password in Ubuntu for deeper troubleshooting.

🧩 Conclusion

Changing or resetting the root password on Ubuntu is one of those basic administrative tasks that ensures only you have access to the system, keeping it secure. Knowing how root and sudo accounts are managed helps you avoid lockouts and unauthorized access. You now know how to set, change, verify, re-lock, and recover the root password — and how to secure root access over SSH. If you want a secure, ready-to-use environment to apply these methods, consider getting an Ubuntu VPS from MonoVM — a reliable, high-performance platform for development and server management.

Category: Ubuntu