What is the difference between /etc/passwd and /etc/shadow in Linux?
Learn the difference between /etc/passwd and /etc/shadow in Linux: what each file stores, why hashes are split out, and how permissions keep passwords safe.
Expected Interview Answer
/etc/passwd stores public account information such as username, UID, GID, home directory and login shell, while /etc/shadow stores the encrypted password hashes and password-aging policy and is readable only by root.
Historically passwords were hashed directly in /etc/passwd, but because that file must be world-readable for name-to-UID lookups, the hashes were split out into /etc/shadow, which has restrictive 0640 (or 0600) permissions owned by root. In /etc/passwd the second field now just holds an 'x' pointing to /etc/shadow, which additionally records last-change date, minimum and maximum age, warning period and expiry.
- Keeps password hashes unreadable to normal users
- Allows /etc/passwd to stay world-readable for lookups
- Supports password aging and account expiry policies
- Separates public identity from secret credentials
- Reduces the attack surface for offline hash cracking
AI Mentor Explanation
Think of /etc/passwd as the printed team sheet pinned in the pavilion: anyone can read each player's name, cap number and batting position. /etc/shadow is the sealed selectors' folder in the captain's locker holding the secret vault PINs and contract renewal dates — only the manager can open it, so opponents reading the public sheet learn nothing confidential.
Step-by-Step Explanation
Step 1
Inspect /etc/passwd
Run cat /etc/passwd and note each colon-separated line: username, x, UID, GID, GECOS, home directory, login shell.
Step 2
Spot the password empty slot
See the 'x' in the second field — it signals that the real hash lives in /etc/shadow, not here.
Step 3
Check permissions
ls -l shows /etc/passwd is 0644 (world-readable) while /etc/shadow is 0640 or 0600, owned by root:shadow.
Step 4
Read /etc/shadow as root
sudo cat /etc/shadow reveals the username, hashed password and the aging fields (last change, min, max, warn, inactive, expire).
Step 5
Understand aging fields
Interpret the numeric fields as days since epoch and policy limits that control when a password must change or expires.
What Interviewer Expects
- Knows /etc/passwd is world-readable and /etc/shadow is root-only
- Explains why hashes were separated out historically
- Can name the fields of both files
- Understands the 'x' empty slot linking the two files
- Aware of password-aging fields in /etc/shadow
Common Mistakes
- Claiming /etc/passwd stores the actual password hash today
- Thinking /etc/shadow is world-readable
- Confusing UID and GID fields
- Not knowing the 'x' points to /etc/shadow
- Assuming both files have identical permissions
Best Answer (HR Friendly)
“In Linux, /etc/passwd is a public list of user accounts with details like username and home folder, while /etc/shadow is a protected file that only administrators can read because it holds the encrypted passwords. Splitting them keeps the secret parts safe while letting the system look up account info normally.”
Code Example
# Public account info (world-readable)
grep '^alice' /etc/passwd
# alice:x:1001:1001:Alice A:/home/alice:/bin/bash
# Secret hashes and aging (root only)
sudo grep '^alice' /etc/shadow
# alice:$6$rXk...:19722:0:99999:7:::
ls -l /etc/passwd /etc/shadow
# -rw-r--r-- root root /etc/passwd
# -rw-r----- root shadow /etc/shadowFollow-up Questions
- What does each colon-separated field in /etc/passwd mean?
- What are the password-aging fields in /etc/shadow?
- Which hashing algorithm does the $6$ prefix indicate?
- What is the role of /etc/group and /etc/gshadow?
- How does the 'x' in the password field work?
MCQ Practice
1. Where are Linux user password hashes stored on a modern system?
Modern systems keep hashes in /etc/shadow, which is readable only by root, while /etc/passwd holds an 'x' empty slot.
2. What does the 'x' in the second field of /etc/passwd indicate?
The 'x' tells the system to look up the actual password hash in /etc/shadow rather than in /etc/passwd.
3. Which permission is typical for /etc/passwd?
/etc/passwd is world-readable (0644) so any process can resolve UIDs to usernames, unlike the restricted /etc/shadow.
Flash Cards
What does /etc/passwd store? — Public account info: username, UID, GID, GECOS, home directory and login shell — world-readable (0644).
What does /etc/shadow store? — Encrypted password hashes plus aging fields, readable only by root (0640/0600, owned root:shadow).
What is the 'x' in /etc/passwd? — An empty slot in the password field meaning the real hash lives in /etc/shadow.
Why were the files split? — So /etc/passwd can stay world-readable for lookups while password hashes stay hidden from normal users.