Where to find password for users created in Ubuntu (16.04)

There are two main files related to system user authentication: /etc/passwd and /etc/shadow. The actual user's passwords are stored as hashed version in the shadow file. They are hashed by the crypt function. It is not possible to "decrypt" any password from the shadow file, because hashing is one way mechanism.

Most simply: When the user enters а password, it is processed and compared to the hashed password stored in the shadow file. But when one try to "decrypt" a password from the shadow file - there are over than thousands possible results.

Relevant questions:

• How to decode the hash password in /etc/shadow
• Change password on root user and user account

/etc/passwd contains one line for each user account, with seven fields delimited by colons (:).

These fields are: 1. login name; 2. optional encrypted password; 3. UID; 4. GID; 5. user name or comment field; 6. user home directory; 7. optional user command interpreter.

The encrypted password field may be blank, in which case no password is required... However, some applications which read the /etc/passwd file may decide not to permit any access at all if the password field is blank.

If the password field is a lower-case x, then the encrypted password is actually stored in the shadow file instead; there must be a corresponding line in the /etc/shadow file, or else the user account is invalid. If the password field is any other string, then it will be treated as an encrypted password, as specified by crypt. (source: man passwd)

/etc/shadow - shadowed password file - is a file which contains the password information for the system's accounts and optional aging information. Each line of this file contains 9 fields, separated by colons (:).

The fields are: 1. login name; 2. encrypted password - refer to crypt for details on how this string is interpreted; 3. date of last password change; 4. min password age; 5. max password age; 6. password warning period; 7. password inactivity period; 8. account expiration date; 9. reserved field. (source: man shadow).