Reset a Forgotten Linux User or Root Password

sudo passwd yourusername

mount -o remount,rw /
passwd yourusername
# Fedora, openSUSE and other SELinux systems only:
touch /.autorelabel
sync
exec /sbin/init

Identify your case

Pick the method that matches your setup. All of them need physical access to the machine; none of them work remotely.

First, confirm your username. It is not always the display name shown on the login screen. If you can reach any root shell, ls /home or getent passwd | awk -F: '$3>=1000{print $1}' lists regular accounts.

Get to the boot menu

Ubuntu and Fedora hide the menu when only one OS is installed. Hold Shift (BIOS systems) or tap Esc (UEFI) right after the firmware logo. If tapping Esc too often drops you to a grub> prompt, type normal and press Enter. With systemd-boot (common on Arch), press e on the entry to edit its options. The full editing procedure is in how to set kernel parameters.

Reset the password

Use the first method that fits your system. Each one ends with a working passwd command run as root.

Method 1: Ubuntu recovery mode

1. In GRUB choose Advanced options for Ubuntu, then an entry ending in (recovery mode).
2. In the recovery menu, choose root (Drop to root shell prompt). Press Enter when asked.
3. Remount the root filesystem read-write and reset the password:

   mount -o remount,rw /
   passwd yourusername
   sync
   reboot

Ubuntu locks the root account by default, and recovery mode still gives you a root shell without asking for a password. On Debian, recovery mode asks for the root password; if you set none during installation it reports that the root account is locked. Use Method 2 then.

Method 2: init=/bin/bash (any distro)

This makes the kernel start a root shell instead of systemd, skipping every login.

1. Highlight your normal boot entry and press e.
2. Find the line beginning with linux (GRUB) or the options line (systemd-boot). Remove quiet splash or rhgb quiet if present, and add init=/bin/bash at the end.
3. Press Ctrl+X or F10 to boot. The change is not saved.
4. At the # prompt:

   mount -o remount,rw /
   passwd yourusername
   # also reset root if you want to:  passwd root

5. On systems with SELinux enforcing (Fedora, openSUSE Leap 16, RHEL family), schedule a relabel. passwd recreated /etc/shadow without its SELinux label, and without a relabel nobody can log in:

   touch /.autorelabel

6. Flush writes and continue booting:

   sync
   exec /sbin/init

   If that does not work, use reboot -f; because systemd is not running, a normal reboot fails.

The relabel on the next boot can take several minutes and reboots once on its own. Do not interrupt it.

Method 3: rd.break on Fedora

rd.break stops inside the initramfs, before the real root is switched to. It is the method Red Hat documents and works well on Fedora's Btrfs layout.

1. Edit the boot entry, add rd.break to the end of the linux line, boot with Ctrl+X.
2. At the switch_root:/# prompt:

   mount -o remount,rw /sysroot
   chroot /sysroot
   passwd yourusername
   touch /.autorelabel
   exit
   exit

The first exit leaves the chroot, the second continues booting. If the disk is encrypted, you are asked for the LUKS passphrase before the prompt appears.

Method 4: live USB and chroot

Use this when the boot menu is password-protected, the system does not boot, or you prefer not to edit boot entries. Boot any current live USB (Ubuntu, Fedora) and open a terminal.

# find the Linux root partition
lsblk -f
# mount it (example: /dev/nvme0n1p2)
sudo mount /dev/nvme0n1p2 /mnt
# Fedora's Btrfs root lives in a subvolume:
# sudo mount -o subvol=root /dev/nvme0n1p3 /mnt
sudo chroot /mnt passwd yourusername
sudo umount /mnt

Running only passwd inside the chroot changes the password in the installed system's /etc/shadow, not the live session's. On SELinux systems, also run sudo touch /mnt/.autorelabel before unmounting. If the root is on LVM, activate it first with sudo vgchange -ay and mount the logical volume shown by lsblk.

The LUKS caveat: disk encryption is separate

If you are asked for a passphrase before the login screen (a text prompt or a graphical "Please unlock disk"), that is the LUKS disk-encryption passphrase, not your user password. None of the methods above can reset it, because the data is encrypted with a key that only the passphrase unlocks.

• Try any other passphrase you may have added: LUKS has several key slots. List them with sudo cryptsetup luksDump /dev/nvme0n1p3 from a live USB.
• If you set up a recovery key (Ubuntu's installer can create one for TPM-backed encryption), use it now.
• Without any working key, the data is not recoverable. Reinstall and restore from backup.

With LUKS you can still reset a forgotten login password: unlock the disk with the passphrase, then use any method above. From a live USB, open it first:

sudo cryptsetup open /dev/nvme0n1p3 cryptroot
sudo vgchange -ay
lsblk -f
sudo mount /dev/mapper/ubuntu--vg-ubuntu--lv /mnt

The mapper name depends on your layout; use the one lsblk shows.

After the reset

• Keyring prompts: GNOME Keyring and KDE Wallet still use the old password. If you do not remember it, delete the login keyring to start fresh (this loses saved Wi-Fi, browser and app secrets): mv ~/.local/share/keyrings/login.keyring ~/login.keyring.old.
• Not an admin? If sudo says you are not allowed, see user is not in the sudoers file, and the user management guide for groups.
• systemd-homed or ecryptfs home directories are encrypted with the user password itself. Root cannot reset these without the old password; resetting would leave the home directory unreadable.

Special cases

The boot menu is password-protected

Some systems set a GRUB password, which blocks pressing e to edit entries. You will see a username and password prompt instead of the editor. In that case:

• Use Method 4 from a live USB. The GRUB password protects only the boot menu, not the disk.
• If the firmware also has a boot password or Secure Boot settings that prevent USB boot, you need the firmware (BIOS/UEFI) supervisor password, or the machine's owner. On company laptops, ask IT: resetting firmware passwords usually requires the vendor.

Once you are back in, you can remove or change the GRUB password in the files under /etc/grub.d/ (look for password_pbkdf2) and run sudo update-grub (Debian/Ubuntu) or sudo grub2-mkconfig -o /boot/grub2/grub.cfg (Fedora).

Should you set a root password?

Ubuntu and Fedora's default installs lock root and rely on sudo. That is fine, but it means a forgotten admin password locks you out of system administration entirely until you use the methods above. A root password helps only with local recovery: Debian's recovery mode and the emergency shell accept it. If you set one, make it long and different from your user password:

sudo passwd root

To lock root again later, run sudo passwd -l root. Remote root login over SSH is disabled with a password by default on current OpenSSH configurations, so a root password does not open that door.

Distro notes

• Ubuntu 26.04 / 24.04 and Mint: recovery mode is fastest. Ubuntu 26.04 uses sudo-rs, which behaves the same for sudo passwd.
• Debian 13: if you set a root password at install, log in as root on a text console (Ctrl+Alt+F3) and run passwd user. Otherwise use Method 2.
• Fedora 44: Method 3 or Method 2; always create /.autorelabel.
• Arch Linux: Method 2, or chroot from the Arch ISO with arch-chroot /mnt passwd user.
• openSUSE: Method 2 works; Leap 16 uses SELinux by default, so relabel. With Btrfs snapshots, mount the default subvolume (plain mount does this).

Prevent it next time

Anyone with physical access can do what this guide describes, so treat it as a reminder: full-disk encryption is what actually protects a laptop's data. Keep a second admin account or a written-down root password in a safe place, and store your LUKS recovery key somewhere other than the encrypted machine. If the boot menu is gone entirely, start with the GRUB rescue guide.

Frequently asked questions