Locked Out of Ubuntu? Reset a Local Account Password Safely

A forgotten Ubuntu login password is usually recoverable if you have access to the machine’s boot menu. The right steps depend on whether you’re locked out of a local computer, a remote server, or an encrypted disk—and those are not interchangeable problems.

Use these instructions only on a device you own or are authorized to administer. If you can still sign in with another administrator account, use that route first. For a hosted server, start with your provider’s console or recovery process; a normal SSH session does not give you access to the machine’s GRUB menu.

First, identify what credential is missing

Ubuntu’s account password is not the same as:

• The passphrase that unlocks an encrypted disk at startup.
• An SSH private key or its passphrase.
• A password for a separate service or account.

Resetting a local Ubuntu account password does not recover an encrypted disk’s passphrase or a lost SSH key. If the disk is encrypted, you still need its existing passphrase to access the installed system.

If another administrator account is available, sign in and run:

sudo passwd username

Replace username with the affected account’s actual name. Enter the administrator’s password when sudo prompts you, then enter and confirm a new password for the target account. Ubuntu commonly grants administrative access through sudo; you generally do not need to enable a separate root password. If you need a refresher on the command’s behavior, see this guide to changing a password in Linux.

Reset it from GRUB recovery mode

On a physical Ubuntu machine with a standard GRUB recovery entry, the usual path is to boot into recovery mode and open a root shell. Menu labels and startup keys can vary by release and hardware.

1. Restart the computer. If the disk is encrypted, unlock it with its existing passphrase when prompted.
2. Open GRUB. On many legacy BIOS systems, hold Shift shortly after firmware startup. On many UEFI systems, tap Esc repeatedly. Timing differs between machines.
3. Choose Advanced options for Ubuntu, then select an entry marked (recovery mode). If there are several, start with the newest kernel’s recovery entry.
4. Select the root shell option if it is available.
5. In the recovery shell, identify the account and make the installed root filesystem writable if necessary:

ls /home
mount -o remount,rw /
passwd username

Use the exact local account name in place of username. Names under /home often match account names, but do not assume they always do. If you are unsure, verify the account before changing its password:

getent passwd username

When passwd asks for a new password, the characters you type will not appear on screen. Confirm it at the second prompt. A success message indicates that the account password changed. Then choose the recovery menu’s resume or reboot option, or enter reboot at the shell.

If passwd reports that the user does not exist, stop and check the account name rather than trying guesses. If the shell is read-only, run the remount command before retrying passwd.

If recovery mode is unavailable

A live Ubuntu USB can be a fallback when you have physical or console access to the machine. The broad process is to boot the live environment, identify the installed system’s root filesystem, mount it, and use chroot before running passwd for the installed account.

Do not assume a device path such as /dev/sda1 is correct for your computer. Inspect the available filesystems with lsblk -f and identify the actual Ubuntu root partition before mounting anything. Encryption, LVM, Btrfs subvolumes, and other partition layouts can require different steps. If you cannot confidently identify the root filesystem, stop rather than modifying a guessed partition. A live USB does not bypass disk encryption; you still need the existing encryption passphrase.

For a cloud VM or hosted server, use the provider’s documented recovery workflow or console instead. A local keyboard sequence for GRUB may not be available through SSH. If you are setting up remote access after recovery, this Ubuntu Server setup guide covers the broader server and SSH configuration context.

What to expect after the reset

Changing the Ubuntu account password updates that account’s login credential. It does not change the disk-encryption passphrase, set a separate root password, or create a replacement SSH key.

SSH access is controlled separately by the server’s configuration. A reset may change the password used for SSH password authentication, but it will not help if password authentication is disabled, the account is restricted, or the server requires a key you no longer have.

You may also see a prompt about the login keyring after signing in. If the keyring was protected by the old account password, Ubuntu may not be able to unlock it automatically with the new one. That is a separate issue and does not necessarily mean the password reset failed.

Quick checks if something goes wrong

• GRUB does not appear: Try the startup key for your firmware type; timing varies. For a hosted machine, use its provider console.
• The recovery shell is read-only: Run mount -o remount,rw /, then retry passwd username.
• The account is not found: Verify the exact local username with getent passwd username.
• The encrypted disk will not unlock: The account reset cannot replace the existing disk passphrase.
• You can log in locally but SSH still fails: Check the remote username and server authentication policy; a local reset does not restore a missing key.
• A keyring prompt appears: Treat it as a separate keyring issue, not proof that the account password change failed.

The safest recovery path is the one that matches the credential and machine you actually control. When you are unsure which partition or account is involved, pause before making changes and consult the machine’s administrator or provider.

I originally published a more detailed version of this guide on the SSHFlow blog.

I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.