Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm newbie in Ubuntu and currently using it for assignment.

I've checked my encrypted password at /etc/shadow folder and found that my encrypted password using MD5 encryption, but my problem is the salt length is 5.
I've check various sites saying that the MD5 salt should be length of 8 while mine is only 5.

Here is what I get when I run sudo grep <username> /etc/shadow:


My questions are:

  1. What is the algorithm if it's not MD5?
  2. How come the salt length is 5?
  3. Anyway to change the length of the salt?
share|improve this question
Either you have customized things or you are running an old Ubuntu release (my /etc/pam.d/common-password has a comment that reads Prior releases used the option "md5", although I'm not 100% sure this applies to Ubuntu). – Andrea Corbellini Aug 18 '13 at 17:34
Certainly didn't customize things, I re-installed ubuntu 12.04 using Wubi but still the same. Same here when I read my /etc/pam.d/common-password got the "Prior releases used the option 'md5'" – Poh Sun Aug 18 '13 at 18:10

What is the algorithm if it's not MD5?

  • Ubuntu by default uses sha512. See ....

    cat /etc/login.defs
  • My password in /etc/shadow starts with $6$

  • I believe we started using sha512 instead of MD5 since Ubuntu 9.10.

Anyway to change the length of the salt?


lets you use variable salts.

share|improve this answer
I thought so too because before I used Ubuntu 12.04 which is SHA-512 and got no problem Then I re-installed because I screwed up my passwd file. When I re-check on this new installed Ubuntu, it shows me different. – Poh Sun Aug 18 '13 at 17:39
When I use mkpasswd with SHA512 or MD5, it gives me errors that the length of the salt is not enough. My assignment question requires me to compare user input password and the account password. Or, is there anyway to compare user input password and account password? – Poh Sun Aug 18 '13 at 17:45
The salt is probably 16+ chars ;) – Rinzwind Aug 18 '13 at 18:15
16+ chars? Possible? Because the maximum salt length I know for SHA-512 is 16 – Poh Sun Aug 18 '13 at 18:21
@Rinzwind Ubuntu/Linux/PAM's limit? AFAIK SHA512 can take any salt. – hexafraction Aug 21 '13 at 7:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.