# How to Change the Root Password on a Linux Server Source: https://lyrahosting.com/how-to/how-to-change-the-root-password/ 1. [Home](https://lyrahosting.com/) 2. [How-to](https://lyrahosting.com/how-to/) 3. How to Change the Root Password on a Linux Server How-to Written by [the LyraHosting technical team](https://lyrahosting.com/about-us/#team) · Reviewed by Erik, certified Linux system administrator (LFCS) · Published 7 Nov 2026 · 4 min read This guide changes the password of the root account on a Linux server, on a VPS or a dedicated server. The commands are the same on Ubuntu, Debian and Red Hat-family systems such as RHEL, AlmaLinux and Rocky Linux. It also covers changing your own user's password, and why SSH keys are the better way to log in. When a LyraHosting server is deployed or reinstalled, its root account is given a generated password. Replace it with a password of your own before you start to use the server. A reinstall sets a new generated password, so change it again after each reinstall. On a [Storage VPS](https://lyrahosting.com/offshore-storage-vps/), you choose the root password yourself when you order. ## Before you start - Log in as root, or as a user who can run commands with `sudo`. - Have a password manager ready to create and store the new password. - Know what to do if you lose it. On a LyraHosting [Linux VPS](https://lyrahosting.com/offshore-linux-vps/), the control panel can reset the root password. On a [dedicated server](https://lyrahosting.com/offshore-dedicated-servers/), open a support ticket in the client area (see [Contact us](https://lyrahosting.com/contact-us/)). ## Change the root password 1. When you are logged in as root, run `passwd` without a user name: ``` passwd ``` As a user with sudo rights, name the root account: ``` sudo passwd root ``` 2. Type the new password, then type it again to confirm. 3. Store the new password in your password manager before you close your session. The superuser can change any password without knowing the old one, so as root you aren't asked for it. Through `sudo`, you first enter your own password, the one sudo asks for. When the change is done, `passwd` reports that the password was updated. ## Choose a strong password Length counts for more than unusual characters. [The passwd manual](https://man7.org/linux/man-pages/man1/passwd.1.html) advises a long, random password, and shows that 32 random lowercase letters already give about 2 to the power of 150 combinations. Avoid dictionary words, names, birth dates, addresses and anything else someone could guess about you. A password manager can generate a random password and remember it for you. Don't use the root password anywhere else, and don't give it out. Debian's installation guide tells you to be extremely wary of anyone who says they need it. ## Root on Ubuntu and Debian: locked or not A standard Ubuntu installation locks the root account: root has a password that matches nothing, and administrators use `sudo` with their own password instead. Debian does the same when no root password is set during installation, and lets the first user use sudo. Check the state of root on your server: ``` sudo passwd -S root ``` The second field shows `L` for a locked password, `NP` for no password and `P` for a usable one. If root is locked and you manage the server with sudo, you don't need a root password, and you can leave it locked. Setting one with `sudo passwd root` enables the account. To lock it again, run `sudo passwd -l root`. A locked password doesn't stop logins with an SSH key. ## Change your own user's password Any user can change their own password with `passwd`. It asks for the current password first, then for the new one twice: ``` passwd ``` As root, or with sudo, you can set another user's password with `sudo passwd username`. If you work through sudo, your own password is the one that guards root access, so give it the same care as a root password. ## Log in with SSH keys instead [Ubuntu's documentation](https://ubuntu.com/server/docs/how-to/security/user-management/) points out that many successful break-ins use simple brute-force and dictionary attacks against weak passwords. SSH keys avoid that. Create a key pair on your own computer, then copy the public key to the server: ``` ssh-keygen -t ed25519 ssh-copy-id youruser@203.0.113.10 ``` Once you can log in with the key, you can turn off password logins over SSH: set `PasswordAuthentication no` in `/etc/ssh/sshd_config`, check it with `sudo sshd -T | grep -i passwordauthentication`, and restart SSH (`sudo systemctl restart ssh` on Ubuntu and Debian, `sudo systemctl restart sshd` on RHEL, AlmaLinux and Rocky Linux). Test a key login from a second terminal before you close your session. Our guide on [changing the SSH port](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/) covers the same safety steps. For root, [OpenSSH's default setting](https://man7.org/linux/man-pages/man5/sshd_config.5.html) `PermitRootLogin prohibit-password` refuses password logins and allows keys, but your server's configuration may set it differently. Check it with `sudo sshd -T | grep -i permitrootlogin`. A new password doesn't remove keys. Anyone whose public key is in `/root/.ssh/authorized_keys` can still log in as root. If you're changing the password because someone else had access, check that file too, along with the `.ssh/authorized_keys` file of each user. In this article 1. [Before you start](https://lyrahosting.com/how-to/how-to-change-the-root-password/#before-you-start) 2. [Change the root password](https://lyrahosting.com/how-to/how-to-change-the-root-password/#change-the-root-password) 3. [Choose a strong password](https://lyrahosting.com/how-to/how-to-change-the-root-password/#choose-a-strong-password) 4. [Root on Ubuntu and Debian: locked or not](https://lyrahosting.com/how-to/how-to-change-the-root-password/#root-on-ubuntu-and-debian-locked-or-not) 5. [Change your own user's password](https://lyrahosting.com/how-to/how-to-change-the-root-password/#change-your-own-user-s-password) 6. [Log in with SSH keys instead](https://lyrahosting.com/how-to/how-to-change-the-root-password/#log-in-with-ssh-keys-instead) Keep exploring [All how-to guides](https://lyrahosting.com/how-to/) [Talk to our team](https://lyrahosting.com/contact-us/) ## Host it offshore with LyraHosting KVM virtual servers in the Netherlands with full root access, from €8.99 a month. [Explore offshore VPS](https://lyrahosting.com/offshore-linux-vps/) [Contact us](https://lyrahosting.com/contact-us/) Keep reading ## More from the how-to [View all](https://lyrahosting.com/how-to/) 01 / From the journal How-to · 9 Jun 2022 ### [How to Change the IP Address of a Linux Server](https://lyrahosting.com/how-to/how-to-change-ip-address-of-your-server/) Change a Linux server's IP address on Ubuntu, Debian, RHEL, AlmaLinux or Rocky Linux: test the new address first, then make it permanent. 5 min read [Read article](https://lyrahosting.com/how-to/how-to-change-ip-address-of-your-server/) 02 / From the journal How-to · 8 Jun 2022 ### [How to Set Up an OpenVPN Server on Ubuntu LTS](https://lyrahosting.com/how-to/how-to-setup-an-openvpn-server-on-ubuntu-18-0420-0422-04-lts/) Set up an OpenVPN server on Ubuntu 24.04 or 22.04 LTS with the openvpn-install script: the firewall, client files, and adding or revoking clients. 9 min read [Read article](https://lyrahosting.com/how-to/how-to-setup-an-openvpn-server-on-ubuntu-18-0420-0422-04-lts/) 03 / From the journal How-to · 25 May 2022 ### [How to Upgrade Ubuntu 20.04 LTS to 22.04 LTS](https://lyrahosting.com/how-to/how-to-upgrade-from-ubuntu-20-04-lts-to-22-04-lts/) Ubuntu 20.04 is out of standard support. Upgrade a server to 22.04 LTS over SSH with do-release-upgrade, then on to 24.04 and 26.04. 7 min read [Read article](https://lyrahosting.com/how-to/how-to-upgrade-from-ubuntu-20-04-lts-to-22-04-lts/)