fren
Log In

Change the root password of a VPS

2 min read07 November 2026

Changing the root password is simple, but it has side effects: scripts, backups and monitoring tools that authenticate with the old password keep failing silently. Do it in order, then update every place where the secret is stored.

Change from a root session

Logged in as root, run:

Bash
passwd

The program asks for the new password twice and does not echo it. To change another account's password from root:

Bash
passwd utilisateur

A long, unique password generated by a password manager beats a reused memorable phrase. Do not pass it as a command-line argument: it would remain in shell history.

Check the account state

Bash
passwd -S root
chage -l root

passwd -S reports whether the password is set (P), locked (L) or absent (NP). chage -l shows the last change date and any expiry. A locked account cannot log in even with the right password; in that case unlock it with passwd -u root after understanding why it was locked.

Reset from the panel

If you can no longer log in, the dashboard offers a root password reset on the VPS page. Depending on the panel, the action may reboot the container. Keep the console open and wait for it to finish before retrying SSH. The reset changes neither your files nor your SSH keys: it only replaces the account secret.

Fall back to the console

If the panel is not enough, open the noVNC console and log in with a local account that has sudo:

Bash
sudo passwd root

The console is independent of the network and SSH. It is the fallback when a firewall rule or an sshd configuration cut your access.

Update stored credentials

A root password change updates nothing automatically. Review:

  • the password manager and team shares;
  • backup and deployment scripts;
  • cron jobs and systemd timers using sshpass or a key;
  • monitoring tools and third-party panels;
  • saved credentials in browsers or SSH clients.

Prefer a dedicated SSH key per tool: it can be revoked without touching the root password. After the change, test a new login in a second session before closing the first. If a service fails, read journalctl -u service-name rather than restoring the old password.

Advertisement

Was this article helpful?

Read next