Ubuntu ships with the root account locked, so on a default install there is no root password to recover. Resetting root means giving the account a password where it had none, or replacing one that no longer works.
The way in is the recovery shell, and the step that decides whether it works is not the password command. It is the remount that gives the root filesystem write access, because passwd writes to /etc/shadow and a read-only root refuses it with an error that names a token.
What Ubuntu’s root account is when you cannot log in as root
Ubuntu disables the root password when it installs, which is why a normal login never asks for one. Administrative work goes through sudo with your own account password, and root stays locked until something gives it a password.
Check the state before you change anything, because the first field of the status output carries the whole answer.
sudo passwd -S root
root L 2026-09-15 0 99999 7 -1
A single letter in the first field covers every state you will meet. I checked a fresh Ubuntu 26.04.1 root filesystem and the flag came back L, which is the value a default install reports.
| First field | Account state | What it means |
|---|---|---|
| L | Locked | No password authenticates as root. This is what Ubuntu installs. |
| P | Usable password | Root has a password that works. passwd replaces it. |
| NP | No password | The field in /etc/shadow is empty, so root belongs to nobody. |
The rest of the line is aging, from the minimum and maximum password age through the warning and inactivity windows, and it stays at the Ubuntu defaults unless someone changed them.
A new root password does not turn the account into a login account. Ubuntu keeps root off the desktop login screen and its default SSH configuration refuses password logins for root, so the new password is for the console, for the recovery shell, and for su when you need it.
What you need before you start
Everything below is a local procedure. If the root password is the only way you had into the machine, no amount of SSH gets you past it, so the checklist starts with access rather than with software.
- A keyboard and a screen, or the VNC, serial, or web console your hosting provider exposes.
- Control of the boot sequence. Recovery mode is an entry in the boot menu, so the machine has to reach that menu.
- An account that still authenticates and can use sudo, if one exists. That path skips recovery mode entirely.
- The new password, decided in advance, so you are not inventing one at a blank prompt.
Encryption changes where the sequence starts. Recovery mode hands a root shell to whoever is at the keyboard, which is the reason laptops that travel and servers in shared racks are installed with full disk encryption. When the disk is encrypted, the sequence below starts after the initramfs has unlocked it, and an unlock failure leaves you in the initramfs shell instead.
If nobody on the machine can use sudo at all, the recovery shell is also the way to put an account back into the sudo group before you touch root.
Reset the root password from any account that still has sudo
When one account on the machine still logs in and carries sudo rights, the whole job is a single command and recovery mode is unnecessary.
sudo passwd root
Sudo asks for two different passwords through that one line. The first prompt is your own account password, because sudo is the program running the command, and the next two prompts are the new root password typed twice with nothing echoed back.
The status line reads P once the write lands, which is the confirmation that matters. A successful message alone tells you passwd liked the password, not that the shadow file carries it.
Boot into the recovery shell from the GRUB menu
Recovery mode is a boot entry rather than a program, so this path starts with reaching the boot menu. On UEFI firmware, press Escape repeatedly as the vendor logo clears. On an older BIOS machine, hold Shift instead, and note that the window can be short on a fast boot.
A menu that never appears is a configuration problem rather than a broken machine, and changing the GRUB timeout gives you a menu you can aim at.
Reach the recovery entry
Open Advanced options for Ubuntu and pick the line that ends in (recovery mode). A machine with a single Ubuntu install shows Ubuntu and Advanced options for Ubuntu at the top level, and the recovery entries live inside the submenu.
Answer the maintenance prompt
When the boot cannot finish normally, the screen stops on a single line that reads Give root password for maintenance (or type Control-D to continue). Press Enter to continue into the maintenance shell, or Control-D to abandon it and carry on with a normal boot.
Choose the root shell
The recovery menu lists repair options, and the one you want is root, described as Drop to root shell prompt. Select it and press Enter, and the shell that opens is already root.
Read the title bar before you type anything. It says (filesystem state: read-only), and that read-only note is what the next section is about.
Make the root filesystem writable before passwd
Recovery mode mounts the root filesystem read-only on purpose, so that a broken system is inspected before it is modified. passwd cannot write to /etc/shadow while that is true, and the error it returns does not mention filesystems at all.
Here is that failure, from a run against a root filesystem left read-only. I typed both password entries, and the refusal came at the write rather than at the input:
Nothing was wrong with either password, which means the message is about the shadow file rather than about what you typed. The fix is a remount, not a retry.
mount -o remount,rw /
That command reuses the existing mount and only changes its options, which is why it needs no device name and no mount point beyond the root directory. Older guides pass -n as well, and the flag adds nothing here: it suppresses the write to /etc/mtab that the mount command would make anyway.
I ran the same password change twice against one root filesystem, once read-only and once after that remount, and the retry went through with nothing else about the machine changed.
A separate /boot or /home partition does not change the password write, because /etc/shadow lives on the root filesystem. When you need those partitions mounted for other repair work, mount –all reads /etc/fstab and brings up everything that is listed there.
Set the new password and verify the account state
With the filesystem writable, the same sequence now completes and the account moves from L to P.
Nothing appears on screen as you type the new password, which is normal for passwd and not a frozen terminal.
The tool also accepts what you give it without argument. In the sessions I ran, a six-letter dictionary word went through for root with no warning at all, because the quality check a desktop install applies to normal accounts is not applied to root. Pick a long passphrase yourself, because the prompt will not push back for you.
The passwd command handles every account on the machine, not only root, and password policies are where the rules that do apply to normal accounts are set.
Leave the shell and continue the boot with Control-D, then reboot once you are logged back in and have checked that the new password works from a normal login.
When the recovery menu is not reachable
Some machines break the sequence above, and each case has a way around it.
The GRUB entries are missing or the menu is not shown
You can boot straight past the menu into a shell. Press e on the Ubuntu entry, find the line that starts with linux, append rw init=/bin/bash to the end of it, then press Control-X to boot that configuration once. The approach is documented in the answers on resetting a lost administrative password, and it needs the absolute path to the tool, /usr/bin/passwd, because that shell starts with an empty PATH.
The machine will not boot far enough to offer a menu
A live USB session lets the installed system stay untouched while you work on it. Identify the partition that holds the installation, mount it, and enter it with chroot so that passwd edits the installed /etc/shadow rather than the live session’s own file:
sudo mount /dev/nvme0n1p2 /mnt
sudo chroot /mnt
passwd root
Swap the device name for your own, which detecting the filesystem of an unmounted partition covers if you are unsure which one carries the root directory.
I ran the status check inside a chroot built from a mounted root filesystem, and it reports the installed system’s account state rather than the live session’s. That is how you confirm you are editing the right shadow file.
There is no local console at all
Virtual machines in a cloud account usually have no visible boot menu and no keyboard. The provider’s web console or serial console is the door: it behaves like a screen and keyboard for the guest, so the recovery path works from there. When the console is unavailable too, the remaining options are provider-level, such as attaching the disk to another instance or rebuilding the machine, and both are outside what a password reset can do.
Lock root again once you are back in
Ubuntu locks root on purpose, and a working root password on a machine that anyone can walk up to hands out the same access you just proved is available.
When the emergency is over, put the account back the way Ubuntu ships it:
Locking the account back took one command in my run, and the status flag returned to L while the password string stayed in the shadow file. The lock stops that string from being accepted, so unlocking later restores it.
If you would rather leave root usable, set a long passphrase first. Remote root logins over SSH stay refused either way, so the account is for the console and for su.
Frequently asked questions
The questions below come up around the procedure rather than inside it.
Can I reset the root password without physical access to the machine?
No. Recovery mode is an entry in the boot menu, and nothing in this procedure authenticates over the network. A hosted machine needs the console or serial console its provider exposes.
Why does passwd fail with Authentication token manipulation error?
The root filesystem is still mounted read-only, so the write to /etc/shadow is refused. Run mount -o remount,rw / in the recovery shell and repeat the passwd command.
What does Give root password for maintenance mean?
The maintenance shell is asking for the root password because the boot could not finish normally. Press Enter to continue into that shell, or Control-D to continue a normal boot.
Does a new root password let me log in as root on the desktop?
No. Ubuntu keeps root out of the login screen and its default SSH configuration refuses password logins for root. The password is for the console, the recovery shell, and su.