SHADOW(5)

💖 SHADOW(5) 💖

okay bestie, gather round — this is the manual page for shadow, part of File Formats and Configuration. It's giving ✨secure✨, it's giving 👑main character👑, and it's literally the file that holds every secret your system is keeping. Let's get into it. 🫶

---

🌸 NAME 🌸

shadow — the shadowed password file 💅

---

✨ DESCRIPTION ✨

So shadow is a file, right, and it holds the password info for the system's accounts, plus some optional aging info if you're feeling fancy. It's the whole vibe.

🚨 NOT ME BEING SERIOUS FOR ONE SECOND: this file must not be readable by regular users if you actually want password security to be maintained. Lock it down. No cap. 🔒

Every single line in this file has 9 fields, and they're separated by colons (:) — in this exact order, bestie:

• login name — has to be a valid account name, one that actually exists on the system. Like, it has to be real. 🌟
• encrypted password — okay so here's where it gets juicy:
  • If this field is empty, the user can log in with no password. 😭 But heads up: some applications that read the /etc/shadow file might block access if the password field is empty. So it's giving "technically yes but also maybe no."
  • If the field starts with an exclamation mark !, the password is locked. Whatever characters are left on that line are the password hash.
  • If the password hash is just a star *, password access is basically disallowed — because no password can ever produce a hash like that. It's a fake-out. 💀
  • For the details on how this string gets interpreted, go look at crypt(3). That's the one who knows. 🧚
  • If this field has a string that is not a valid result of crypt(3) — like ! or *, for example — the user cannot log in with a UNIX password. However! They may still log in to the system by other means. Slay, I guess? 🌈
• date of last password change — when the password was last changed, counted as the number of days since 1970-01-01 00:00:00 UTC.
  • The value 0 means the user must change their password the next time they log in. 👀
  • An empty field means password aging features are disabled.
• minimum password age — this field is deprecated, bestie. It should be empty, and it is ignored. Don't bother with it. 🙈
• maximum password age — the number of days after which the user must change their password.
  • After that many days have gone by, the password may still be valid — the user just gets prompted to change it at the next login.
  • An empty field means there is no maximum password age, no password warning period, and no password inactivity period (peep the next two fields below for those).
  • And if the maximum password age is lower than the minimum password age, the user cannot change her password. 😬 Trapped, fr fr.
• password warning period — how many days before the password expires (see maximum password age above 👆) the user gets warned.
  • An empty field or the value 0 means there's no password warning period.
• password inactivity period — the number of days after a password expires (again, see maximum password age above 👆) during which the password is still accepted, and the user has to update it at the next login.
  • Once the password has expired and the inactivity period has elapsed, the user cannot log in and must contact their administrator. 🆘
  • An empty string means no inactivity period is enforced.
• account expiration date — when the account expires, expressed as the number of days since 1970-01-01.
  • Note that account expiration is not the same as password expiration, okay? Account expiration prevents the user from logging in, whereas password expiration only prevents users from logging in with their password.
  • An empty field means the account never expires.
  • The value 0 should not be used, because it gets interpreted either as an account with no expiration or as an expiration date of 1970-01-01. Ambiguous. Messy. Avoid. 💀
• reserved field — reserved for future use. It's just sitting there. Iconic behavior, honestly. ⭐

---

🎀 FILES 🎀

• /etc/passwd — user account information. The public-facing bestie.
• /etc/shadow — secure user account information. The private one. 🤫
• /etc/shadow- — backup file for /etc/shadow.
  • Quick note: this file is used by the tools of the shadow toolsuite, but not by all user and password management tools. So like, it's not universally acknowledged. 💅

---

🦋 SEE ALSO 🦋

chage(1), login(1), passwd(1), passwd(5), pwck(8), pwconv(8), pwunconv(8), su(1), sulogin(8).

---

and that's the whole page, bestie 💖

This one came from shadow-utils 4.20.0, dated 07/30/2026 — so if you see those numbers floating around, that's just the glow-up date of this manual. Go forth and keep your /etc/shadow unreadable by regular users, okay? 🫶✨🔐