Resetting a Forgotten User Password in elementary OS

Forgetting the password on an elementary OS install can feel like hitting a wall, especially when the only thing standing between you and your files is a login screen you no longer recognise. The good news is that elementary OS runs on a standard Linux base, which means the usual recovery pathways found in Ubuntu and Debian remain available under the polished Pantheon desktop. With a few keystrokes at boot time and a handful of terminal commands, you can usually reclaim the account without losing any data stored in the home directory.

The reason this guide exists is that password lockouts tend to happen at the worst possible moment. Maybe you swapped to a new laptop after picking one up from a sale in Melbourne, or perhaps you spun up an old ThinkPad that had been sitting in the study no longer used after an upgrade. Some readers reach this page from a support thread on an Australian NBN provider forum where a technician suggested trying Linux instead of reinstalling Windows. Whatever the path that brought you here, the steps below assume nothing more than physical access to the machine, a working keyboard, and a few quiet minutes.

Before diving in, it helps to know that there are three broad scenarios. The first is the simplest: you remember a sudo-capable password even if your normal login is broken. The second is the classic forgotten password where you need to drop into recovery mode through GRUB. The third covers encrypted home folders, which add an extra passphrase prompt before the recovery can even begin. Each scenario is covered separately, so jump to whichever matches your situation. By the end, you should be able to sign back in, lock the account down properly, and put a plan in place to make sure it never catches you out again.

Understanding Password Recovery Options in elementary OS

elementary OS inherits its user authentication from the upstream Linux PAM stack, which means the same plumbing used by every other Debian-derived distribution is at work beneath the Gala window manager. When you forget the password tied to your regular user, the system does not actually lose track of who you are. The username, UID, and home directory are all still recorded in /etc/passwd. Only the hashed value stored in /etc/shadow has become unguessable to you. This is why password recovery is really about replacing one string in one file rather than rebuilding the account from scratch.

For most readers in Australian homes and small businesses, the easiest path is the one that requires the least command-line work. If another administrator account exists on the laptop, or if your single account still has sudo privileges from a previous session, you can simply reset the lost password from a terminal using sudo passwd username. That works when the box is online and you can reach a shell. It is also the same approach an IT contractor might take when answering a helpdesk ticket from a client in Brisbane who only ever logs in with a fingerprint reader and has now forgotten the backup password.

Where that option is closed off, the recovery route through GRUB becomes the fallback. elementary OS, like most Ubuntu flavours, keeps an older kernel entry available in the boot menu, and that menu can be edited before the system starts. From there you can drop into a root shell, remount the filesystem so changes can be written, and run passwd directly. The trick is knowing which key to press and when. On a Lenovo or Dell laptop bought at a JB Hi-Fi sale in Sydney, you usually hold Shift during a BIOS boot and tap Escape on a modern UEFI system. Once you see the familiar purple GRUB screen, you are in business.

A third scenario deserves a mention up front. If your home folder was created with the option to encrypt its contents, elementary OS uses eCryptfs by default, which means there is a separate mount passphrase that gets generated from your login password. Losing the login password without knowing that secondary passphrase means the encrypted files stay locked away even after you reset the main account credential. That case is covered later in the article, but it is worth flagging now because it shapes which commands you run and how much data you can realistically retrieve.

Reaching the GRUB Menu and Entering Recovery Mode

The first practical step is getting the GRUB boot menu to appear. elementary OS hides this menu by default to keep the boot process tidy, which means the keyboard timing matters more than you might expect. Power on the machine and immediately begin tapping the Shift key on older hardware, or the Escape key on most UEFI laptops shipped after 2018. If you are using a desktop tower from an Australian retailer like Centre Com or Umart, the BIOS may also be set to skip USB keyboards entirely during early boot. In that case, an old PS/2 keyboard or a wired model plugged into a USB 2.0 port is the safest bet.

When GRUB finally shows up, you should see a list of kernels. The top entry is usually the current elementary OS release, with a recovery mode option directly beneath it. Use the arrow keys to highlight the standard entry rather than the recovery one, then press E to edit the boot script. The reason for choosing the normal entry is that recovery mode in elementary OS can sometimes drop you into a read-only shell with limited commands, whereas editing the normal kernel line gives you full control once the system boots.

Look for the line that begins with linux and ends with quiet splash. Move the cursor to the end of that line using the arrow keys. After the splash parameter, add rw init=/bin/bash. This combination tells the kernel to mount the root partition in read-write mode and to drop straight into a Bash shell rather than launching the display manager or the Pantheon desktop. Press F10 or Ctrl+X to boot with these temporary settings. If everything lines up, you should see a brief flurry of boot messages followed by a plain # prompt.

A quick sanity check before going further is to type mount | grep / and confirm that the root partition is mounted read-write. The output should show (rw,relatime) rather than (ro,relatime). If you see the read-only flag, run mount -o remount,rw / and try again. From this shell, every change you make is written to disk just as if you were logged in normally, so be careful with the commands that follow. There is no undo prompt, and there is certainly no Bunnings sausage sizzle to save you if you accidentally type something destructive.

Remounting the Filesystem and Preparing to Edit Accounts

In most cases the rw boot parameter will have already taken care of the read-write issue, but it pays to confirm rather than assume. The root filesystem in elementary OS is typically ext4 on a logical volume or a plain partition, and the kernel treats it as read-only by default unless told otherwise. If the previous step shows (ro,...), the remount command is straightforward and only takes a moment. Once the filesystem is writable, you can edit /etc/shadow directly with a tool like vipw or simply rely on the password utility to handle the rewrite for you.

It is also worth checking that the system clock is roughly correct before resetting anything. Password expiry policies and account aging are tied to the clock, and a wildly wrong date on a machine that has been sitting in a cupboard for a year can prevent logins even after the password is reset. Run date and see what it reports. If the time is off, set it manually with date -s "2026-01-15 10:30 AEST" and press Enter. Australian Eastern Standard Time is the safe default for most readers, but those on the west coast may want to swap in AWST instead.

Once the filesystem is writable and the clock looks sensible, take a moment to inspect the user list with cat /etc/passwd | grep /home. This gives you the exact username string you will need in the next step. On a fresh install, this is usually the short first name you typed during the welcome wizard, lowercased. On older installations configured through Australian university computer labs, the username is sometimes a student number or a Unix-style abbreviation. Knowing the correct identifier is critical, because typing the wrong one will silently reset a password on an account nobody uses.

Changing the Password with the passwd Command

With everything in place, the actual password change is the simplest part of the procedure. From the root shell, type passwd username, substituting the value you confirmed a moment ago. The system will prompt for a new password, then ask you to type it a second time. Unlike graphical login screens, the terminal does not echo the characters back as asterisks, which can feel strange the first time you do it. Keep typing and press Enter after each entry.

When the command finishes successfully, you should see passwd: password updated successfully. That single line is your confirmation that the hash in /etc/shadow has been replaced. At this point you can type reboot -f and watch the system come back up the normal way. If your laptop has a dedicated function key to clear the supervisor password, like the ones used on fleet machines at Australian banks and government agencies, make sure that is cleared first or the new Linux password will not help you at all.

For accounts that need sudo privileges restored, run usermod -aG sudo username before rebooting. This adds the user to the administrative group so that future sudo commands work without further intervention. On a machine that has been in storage since last Australia Day and is now being pressed back into service, this step is often forgotten. Without it, the user can log in and use the desktop, but any attempt to install software, mount drives, or change system settings will throw the dreaded user is not in the sudoers file error.

There is one edge case worth mentioning. If the original password was set with a passphrase that contained characters from a non-English keyboard layout, the reset will succeed but the old passphrase will still be associated with the encrypted home directory. In that situation, log in once with the new password, then update the mount passphrase using ecryptfs-rewrap-passphrase /home/.ecryptfs/username/.ecryptfs/wrapped-passphrase. The command will ask for both the old and new passphrases and rewrite the wrapping key accordingly.

Restoring Missing Accounts on the Login Screen

A surprising number of elementary OS users land on this page because their account has vanished from the GDM login screen entirely, rather than because the password is wrong. This usually happens after a botched update, an interrupted package install, or an attempt to delete another user from a live session. The account is still on the system, but the AccountsService daemon that GDM uses to populate the user list has lost track of it. The fix is to recreate the metadata file that AccountsService relies on.

From the recovery shell, navigate to /var/lib/AccountsService/icons and /var/lib/AccountsService/users. If the user-specific file under the users directory is missing, recreate it with the following pattern: [User]\nIcon=/var/lib/AccountsService/icons/username.png\nSystemAccount=false. Replace username with the value from /etc/passwd and save the file. This brings the account back into the login picker the next time the display manager starts.

If the icon file does not exist, GDM will fall back to a generic avatar, which is fine for getting back in but feels a bit bare. A quick workaround is to copy the default user icon from /usr/share/pixmaps/faces/ into the AccountsService icons directory and rename it to match the username. After a reboot, the login screen should show the account with its usual face. Australian users who travel frequently between time zones sometimes see an extra wrinkle where the session keeps getting timed out due to the screensaver kicking in after a long flight, but that is a separate issue from the missing-account problem.

Handling Encrypted Home Directories

For installations where the home directory was created with encryption enabled, the picture is a little more involved. elementary OS uses eCryptfs to wrap the contents of each home folder, with a per-user mount passphrase that is generated when encryption is first turned on. That passphrase is itself protected by your login password, which means resetting the account password alone will not unlock the data inside. You will also need the original mount passphrase to recover the files.

The recovery command for this case is ecryptfs-recover-private, which scans the system for encrypted home directories and walks you through mounting them with the right key. The tool asks whether you have the mount passphrase, whether you want to try the login passphrase first, and where to mount the recovered folder. On a laptop that belongs to a researcher at CSIRO or a postgraduate student at the University of Queensland, this step is often the only way to retrieve years of experimental data after a password reset.

If the original mount passphrase is truly lost, the data inside the encrypted home directory is effectively gone. There is no backdoor, no master key, and no support hotline that can help, which is precisely why the elementary OS installer warns you to record the recovery passphrase during setup. The recommended workflow is to keep that passphrase in a sealed envelope at home or in a password manager that lives outside the encrypted volume. Once the recovery is finished and you are back inside your account, the passphrase can be rotated using ecryptfs-rewrap-passphrase so that the new login password fully controls the mount.

Putting Safeguards in Place After the Reset

Getting back into the system is only half the job. The other half is making sure the same lockout does not happen in six months when you are tired after a long arvo at work. elementary OS does not ship with biometric login support out of the box, so a written backup or a password manager becomes the safety net. Services like Bitwarden and KeePassXC work well with the platform and can be set up to autofill through the Secret Service API that the Pantheon keyring consumes.

It is also worth enabling a guest session or a second administrator account on machines that are shared. A friend who drops by in Sydney and borrows the laptop to check their email should never have the keys to your entire system. Adding a separate sudo-capable account with a memorable password gives you a reliable fallback the next time you forget the main one. The same advice applies to anyone running a small business on elementary OS, from a Hobart graphic designer to a Darwin-based web studio.

For readers who want to extend the system with new tools once they are back inside, the How to Install and Use the New elementary OS Camera App walks through the steps for setting up the replacement webcam application that arrived in the most recent release. Combining that with a sensible password strategy means the lock screen is the only barrier that ever stands between you and your desktop, which is exactly the kind of low-friction experience elementary OS is designed to deliver.

The key thing to walk away with is this: a forgotten password on elementary OS is a recoverable inconvenience rather than a data-loss disaster, provided you can reach the GRUB menu and you know which of the three scenarios described above applies to your setup. Work through the steps in order, double-check the filesystem state, and resist the urge to reinstall before exhausting the recovery path. With the account restored and a proper backup routine in place, the next time you misplace the credential you will be back at the desktop within minutes.