Updated: 12 October 2026 · Applies to: AlmaLinux 10.2 (RHEL family, shadow-utils 4.15), Debian 13 (shadow 4.17), Ubuntu 24.04 (shadow 4.13) and Ubuntu 26.04 (shadow 4.17)
Password expiry in Linux is set per user with chage. sudo chage -l vyga shows when the password expires, sudo chage -M 90 vyga makes it expire 90 days after the last change, and sudo chage -M 99999 vyga (or -M -1) makes the password never expire. Account expiry is a separate setting: sudo chage -E -1 vyga removes it. The commands and output below are the same on AlmaLinux, Debian and Ubuntu.
1. Check when a password expires
$ sudo chage -l vyga Last password change : Oct 11, 2026 Password expires : never Password inactive : never Account expires : never Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7
This is the default for a new user on all four systems we tested: the password never expires. Add -i to print dates as YYYY-MM-DD. passwd -S gives the same data on one line (user, status, last change, minimum, maximum, warning and inactive days; P means a usable password, L locked):
$ sudo passwd -S vyga vyga P 2026-10-11 0 90 14 -1
2. Set a password expiry policy for a user
- Set the maximum age, the minimum age and the warning period:
sudo chage -M 90 -m 7 -W 14 vyga
-M 90: the password must be changed every 90 days.-m 7: the user cannot change it again within 7 days.-W 14: warn 14 days before it expires. - Optionally lock the account if the password stays expired:
-I 30gives the user 30 more days to change an expired password, then the account is disabled.sudo chage -I 30 vyga
- Optionally end the account itself on a fixed date (for a contractor, for example). Always write the date as YYYY-MM-DD:
sudo chage -E 2027-03-31 vyga
- Check the result:
$ sudo chage -l vyga Last password change : Oct 11, 2026 Password expires : Jan 09, 2027 Password inactive : Feb 08, 2027 Account expires : Mar 31, 2027 Minimum number of days between password change : 7 Maximum number of days between password change : 90 Number of days of warning before password expires : 14
The same values are stored in /etc/shadow as days since 1 January 1970 (fields 3 to 8: last change, minimum, maximum, warning, inactive, account expiry): vyga:HASH:20737:7:90:14:30:20908:. passwd -x 60 -n 1 -w 10 vyga sets maximum, minimum and warning days too (tested on AlmaLinux 10.2).
Watch the date format. chage does not reject other formats, it guesses. In our tests on AlmaLinux 10.2 and Ubuntu 24.04 and 26.04, chage -E 31-03-2027 returned success and set the account to expire on Sep 16, 2036; on AlmaLinux, 2027-31-03 gave Jul 03, 2029. Use YYYY-MM-DD and check with chage -l after every change.
3. Make a password never expire
Set the maximum age back to 99999 days (or -1, which leaves the field empty). Both show "never":
sudo chage -M 99999 vyga sudo chage -l vyga | head -3
Last password change : Oct 11, 2026 Password expires : never Password inactive : never
To clear every limit at once (no minimum age, no expiry, no inactive lock, no account expiry):
sudo chage -m 0 -M 99999 -I -1 -E -1 vyga
Use this for service accounts and for the account you use to manage a server. For people, a never-expiring password is safer when it is long and unique, combined with SSH keys and a block on reused passwords (see How to Prevent Users From Reusing Their Last 10 Passwords).
4. What the user sees when the password expires
We logged in with su - vyga on Debian 13 after each setting (Ubuntu 24.04 and 26.04 printed the same "password expired" message):
- Within the warning period:
Warning: your password will expire in 5 days.The login continues. - After the maximum age:
You are required to change your password immediately (password expired).followed byCurrent password:. The user must choose a new password before getting a shell. - After the inactive period, or after the account expiry date:
Your account has expired; please contact your system administrator.andsu: Authentication failure. Only root can fix this, for example withsudo chage -E -1 -I -1 vygaand a new password.
To make a user change the password at the next login straight away, use sudo chage -d 0 vyga (the message then ends in "administrator enforced"). The full guide, including SSH logins, is How to Force a User to Change Password at Next Login on Linux and RHEL (passwd and chage).
5. Set the default expiry for new users
New users get their values from /etc/login.defs. AlmaLinux 10.2, Debian 13 and Ubuntu 24.04 and 26.04 all ship with:
PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7
- Edit
/etc/login.defsand set, for example,PASS_MAX_DAYS 90andPASS_WARN_AGE 14. - For a default inactive period, run
sudo useradd -D -f 30(it writesINACTIVE=30to/etc/default/useradd). - Run chage for users that already exist. In our test a user created after the change got 90 days, while the existing user kept 99999: login.defs only applies when an account is created.
6. List password expiry for all users
for u in $(awk -F: '$3>=1000 && $3<60000 {print $1}' /etc/passwd); do
printf '%-8s %s\n' "$u" "$(sudo chage -l "$u" | awk -F': ' '/^Password expires/{print $2}')"
done
vyga password must be changed anita Jan 09, 2027
Root (UID 0) is not in this list: check it with sudo chage -l root.
If your admin account has expired
If root or your only sudo user is blocked with "Your account has expired", start the server from a rescue system, mount its disk (for example on /mnt) and reset the dates there; chage -R works on the mounted system without a chroot shell:
chage -R /mnt -E -1 -I -1 root chage -R /mnt -l root
On a Ucartz VPS, start the rescue system from Virtualizor (How to Enable Rescue Mode for Your VPS Using Virtualizor). For other login problems after a password change, see How to Fix passwd: Authentication token manipulation error in Linux; to stop a user logging in at all, see How to Block or Disable Normal User Logins in Linux?
