You may know that passwords are hashed on Linux systems, and the hashes are stored in the restricted access \/etc\/shadow file. But did you know that you can also determine the hash method that was used and report the number of days since a password was last changed from this file as well?\nTo look at a user record in the \/etc\/shadow file, run a command like this:\n$ sudo grep nemo \/etc\/shadow\n\nYou should see a line that looks something like this:\nnemo:$6$FVYIIgcEcObSsUcf$FsSBlV9soVt.Owbd4xnvhlZzjx73ZBQQBT0WMyah6qcdnH91tBf9C4EaYbRtr7jKGETP\/TwBNjyrDFqhvK0NV1:18698:7:90:7:::\n\n\u00a0\nIn spite of how long that line is, it's quite easy to parse. The first two fields in the lines of this colon-separated file store:\n\nthe username (nemo)\nthe password hash (including the hashing method used) in a $id$salt$hashed format\n\nThat $6$ portion of this string represents the hashing algorithm used.\n\n$1$ means MD5\n$2a$ means Blowfish\n$2y$ means Blowfish\n$5$ means SHA-256\n$6$ means SHA-512\n\nThe major portion of nemo's \/etc\/shadow file entry represents the password hash. The following numeric fields (18698:7:90:7:::) represent:\n\nthe date of the last password change in a "days since the epoch" format (18698)\nthe minimum required days between password changes (7)\nthe maximum allowed days between password changes (90)\nthe number of days in advance to display password expiration message (7)\nthe number of days after password expiration to disable the account (not set above)\nthe account expiration date (not set above)\na reserve field (not set above)\n\nTo find today's date in the "days since the epoch" form, you can run a command like that shown in the alias below that divides the "seconds since the beginning of the Unix epoch" by 86,400 (the number of seconds in a day).\n$ alias epoch_date="echo $(( $(date +%s) \/ 86400 ))"\n$ epoch_date 18855\n\nYou can then take that first field shown in the numeric fields (18698) of the \/etc\/shadow file and determine how many days ago the password was changed. In this example, it was 157 days ago.\n$ expr 18855 - 18698\n157\n\nYou can also determine the date the password was last changed by using the chage command that grabs the data from the \/etc\/shadow file and reports that date along with other password stats.\n$ sudo chage -l nemo\nLast password change : Mar 12, 2021\nPassword expires : Mar 12, 2022\nPassword inactive : never\nAccount expires : never\nMinimum number of days between password change : 7\nMaximum number of days between password change : 90\nNumber of days of warning before password expires : 7\n\nWrap-Up\nThe \/etc\/shadow file stores a lot of important settings for passwords on Linux systems, including the algorithm used to create the password hashes and the password last set and expiration dates.