If you mean "system users", ones for some particular service, like
www-data (just to pick some), they usually have their password set to something like
/etc/shadow. It's not empty, but it's also not a valid password hash, so can't be used to authenticate against.
(The way password-based authentication works is that the password given by the user is hashed in the same way the stored password was, and the hashes are then compared to see if they're equal. An invalid hash can't be produced by any password given at login, so the login can never succeed.)
If the password field was actually empty, it would be different, as an empty field marks that no password is required. (Of course the empty string is also not a valid hash, but a special case.) However, at least sshd disallows logins with an empty password anyway (by default, it's configurable with
That said, whatever is in the password field usually only matters for password authentication. SSH keys in particular usually ignore what is in the password field completely. (As stuff like
sudo can also do, if used by a user with enough privileges.)
The Linux man page shadow(5) describes this behaviour.