If I cat /etc/shadow I can get the encrypted passwords of root and my user.

These passwords are the same (I know, bad security) for each account, but in /etc/shadow they show up as being different encrypted strings.

Why? Are different algorithms used for each?

  • I would recommend reading this as a good starting point. The short answer is that the hashes are salted, and that a hash without salt is no hash at all. Jul 30, 2014 at 7:44

3 Answers 3


Separate users means a separate User ID, and therefore separate hashes will be involved with the algorithm.

Even a user with the same name, same password, and created at the same time will (with almost certain probability) end up with a different hash. There are other factors that help create the encryption.

If you want to look at a quick example here it may explain it better.

  • 18
    Just to mention the word here: it's called salting the hash. Jul 30, 2014 at 6:15
  • 1
    Separate users doesn't necessarily mean separate User IDs. User IDs have no bearing on this. The primary key in /etc/passwd, /etc/shadow is the user name, not user ID (which is not even mentioned in /etc/shadow). Jul 30, 2014 at 7:03
  • The explanation doesn't quite answer the question. What has the user ID to do with that at all? Also, the URL does not really shed light on the answer to the question. Jul 30, 2014 at 13:34
  • @StéphaneChazelas No, separate users means separate user IDs. There can be multiple entries in the user database(s) with different user names for the same user ID, but these are all the same user, sharing all security contexts (file ownership, signals, etc.) and differing only in login methods (e.g. different passwords and different shells but leading to the same account). Jul 30, 2014 at 23:09
  • @Gilles, I don't agree. You can have different users with the same uid but different gid and supplementary gids (see how the members in /etc/group are referenced by name, not uid), different login parameters... It's less and less common, especially considering that things like sudo don't work well with that. Jul 31, 2014 at 6:46

The algorithm is the same. Modern shadow-suites use pluggable authentication modules (PAM), and PAM lets you configure one hashing algorithm. It's all about "salting", which means randomizing the password to give the very effect that you're asking about.

Salting is a counter-measure to dictionary attacks, where an attacker with a dictionary of known password/hash pairs tries to find out, whether the given hash value for an unknown password matches the hash value for one of the known passwords.

Salting prevents that as a different salt value leads to a different hash value, so it doesn't matter that the password are equal. (It's nonetheless bad practice, but for other reasons.) For the dictionary attack to succeed, the attacker now has to have dictionaries for every possible salt value. A truly random salt of sufficient size will make the success probability of such an attack negligible.

Suggested reading: How are passwords stored in Linux (Understanding hashing with shadow utils)


In the shadow file you will see a number between $$ (say $1$ or something like that). It indicates which hashing algorithm is used by your machine. Identify the algorithm and see how it works. For instance, $6$ is SHA 512 which is designed in such a way that, even if 2 people have the same password, the hash digest of their password will be different.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .