I don't know much of Ubuntu, but is Ubuntu able to decode these sort of things? Or do I need to install some program? If I don't, how do I use Ubuntu to read the file?

  • you don't need to decrypt a hashed password, that defeats the point of hashing it... – Alvar Nov 27 '13 at 19:32
  • 2
    go through this answer by echox at unix.stackexchange, to know more about hashed passwords. – souravc Nov 27 '13 at 19:36
  • I think what you really want is, is there a way to find the password for a given hash in the /etc/shadow file. The answer is yes. If the hash is an md5, try searching on hash-killer, hashkiller.co.uk/md5-decrypter.aspx. – sybind Sep 7 '14 at 9:34

In short - you can't!

/etc/shadow stores a hashed version of the password. This is, for all intents and purposes, impossible to recover because hashing is a one way operation.

This stops malicious people being able to read the passwords of users on the system.


Let's make it simple : No. Passwords are not meant to be decrypted, what would be the point ? No technique, no utility will allow you to do such a thing. Behind those passwords are huge algorithms meant to be one-way only.

However, you can read the file (and see encrypted passwords) by doing :

sudo cat /etc/shadow

You'll need to be a sudoer, or root himself (in which case, sudo is useless)


here's the deal. You can't decrypt a hashed password, that would ruin the point of hashing.

Hashing works in basic terms, that you take a random string and mix that up (using a certain algorithm) with the password so that it becomes totally unreadable. Then you store this password + hash in a database.

Then how do you know what the correct password is? Well you enter the password and take that same hash string and then you will get the same hash. Then simply compare those hashes and you know if the password is correct.

You can find out what password the user used, but then you need to know what hash string was used to hash it and also you need to know what hashing algorithm was used. Then in the end the solution is still to brute-force the password(try every combination) then hash it and see if it matches the hash that's stored in the database. So for a conclusion, you can "decrypt" a hashed password, but it's not easy.

useful links on the topic:

  • Then, why is it bad if the /etc/shadow contents are known to stranger? He can't use it, correct? – mtk Nov 11 '14 at 6:09
  • 1
    @mtk if you know the hash and the hashed password then you can just bruteforce. If you try enough passwords you will get the correct hash after a while. Hashing is just a way to slow the process once your server has been hacked. You still need to change the passwords that were leaked. – Alvar Nov 11 '14 at 10:24

Ubuntu can't decrypt passwords but you may find john useful:



Yes you can

If you want to decode this password then you need to install john the ripper in your ubuntu with sudo apt-get install john. you just need to copy line of that hash code and create a new file with .PASSWD extension and insert that file into john the ripper tool. It will automatically crack those hashes and give you the password of that particular user.

  • Are you sure that this is not just to test for weak passswords? Can you add an example of a user with a (let's say) 16 or even 32 char password that John can crack? – Rinzwind Aug 14 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.