Shadow Password Files - what they are, why they protect logins, and safe basics

Shadow Password Files

What it is

Shadow password files are special system files on Unix/Linux that store the password hashes (not the actual passwords) for user accounts. Public info about users lives in /etc/passwd, while the sensitive, hashed passwords are kept in /etc/shadow, which only the system (root) can read. Hashes are salted and created with strong algorithms, so even if someone sees them, they can’t easily turn them back into your password.

Why it matters

Keeping hashes in a locked-down file makes it much harder for attackers or nosy apps to steal logins. If the system is set up right, regular users - and most programs - can’t read the password data at all.

How it works 

  • When you set a password, the system makes a salted hash and stores it in /etc/shadow.

  • Login tools check your password by hashing what you typed and comparing the result - your real password is never stored.

  • File permissions keep /etc/shadow off-limits to everyone except the system.

Red flags

  • Password hashes showing up in /etc/passwd (they should not be there).

  • /etc/shadow readable by non-admins (wrong permissions).

  • Lots of failed login attempts or unknown users appearing.

  • Manual edits to these files by someone who isn’t an admin.

Do it right

  • Don’t hand-edit /etc/passwd or /etc/shadow; use system tools like passwd, useradd, usermod.

  • Keep default permissions on /etc/shadow (system-only access).

  • Use strong, unique passwords and a password manager; enable MFA if offered.

  • Remove/lock accounts you don’t use and keep the system updated.

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • Password Sniffer

        What it is A password sniffer is malware or a rogue tool that captures login credentials as they travel over a network. On unsafe Wi-Fi or misconfigured systems, it can read usernames, passwords, cookies, and session tokens to hijack accounts without ...

      • Security Software

        What it is Security software is a set of apps and services that protect your devices and data from hackers, malware, and mistakes. It covers tools like antivirus/anti-malware, firewalls, VPNs, email and web filters, intrusion detection/prevention, ...

      • Shadow Copy

        What it is Shadow copy is a built-in Windows feature that takes quick snapshots of files and folders. These snapshots capture how your data looked at a moment in time, so you can roll back to an earlier version if something goes wrong. Think of it ...

      • Data Execution Prevention

        What it is Data Execution Prevention (DEP) is a Windows safety net that stops code from running in places it shouldn’t—like the stack or heap. If malware tries to execute from those memory areas, Windows blocks it and shuts the app down instead of ...

      • LokiBot (Loki Password Stealer)

        LokiBot (Loki Password Stealer) What it is LokiBot is a credential-stealing trojan that targets Windows and Android. It grabs passwords, cookies, and wallet data, can take screenshots, and sometimes opens a backdoor for more malware. Technical ...