Blog

You're sitting in front of your Kali machine, you type your password, and it's wrong. You try again. Still wrong. You've forgotten it. Before you reach for the USB installer, know that resetting a forgotten Kali password is straightforward—as long as you have physical access and the disk isn't fully encrypted with LUKS. Here are three methods, with exact commands and keystrokes.

Prerequisites and Warnings

These techniques work only when you have direct console access to the computer. They do not work over SSH if the password is unknown, and they will not help if the root filesystem is encrypted with LUKS (unless you also have the LUKS passphrase). Always ensure you are working on your own system or on a lab machine you are explicitly authorized to modify. Unauthorized password reset is a serious security violation.

Method 1: GRUB Recovery Mode (init=/bin/bash)

This is the fastest method. It boots the kernel directly into a root shell without asking for a password. The entire process takes less than a minute.

1. Restart the computer and hold the Shift key (or spam Esc on some BIOS) to bring up the GRUB menu.
2. Select the default Kali entry (usually the first one) and press e to edit the boot parameters.
3. Use the arrow keys to find the line that starts with linux or linuxefi. It typically ends with quiet splash or ro quiet.
4. Replace ro (read-only) with rw (read-write) and add init=/bin/bash at the end of that line. The result should look something like:
   linux /boot/vmlinuz-... root=UUID=... rw init=/bin/bash
5. Press Ctrl+X or F10 to boot with these parameters.
6. You will be dropped into a root shell immediately. The filesystem is already mounted as read-write because of the rw flag.
7. Type passwd and press Enter. Enter the new password twice. If the terminal says passwd: password updated successfully, you’re done.
8. Reboot with exec /sbin/init or simply reboot -f. For safety, also run sync before rebooting.

If your system uses SELinux or AppArmor, the shell may have limited functionality. In practice, Kali does not enforce SELinux by default, so this method should work.

Method 2: Single-User Mode via GRUB (systemd)

Modern Kali releases use systemd. You can boot into rescue.target (single-user mode) to get a root shell without a password.

1. At the GRUB menu, select the Kali entry and press e.
2. Find the linux line and append systemd.unit=rescue.target at the end. Optionally add rw if the line still says ro.
3. Press Ctrl+X to boot.
4. You will see a prompt asking for the root password—but because we booted into rescue mode without a password requirement, it often skips authentication. If it does ask, try pressing Enter with a blank password. If that fails, fall back to Method 1.
5. Once you have a shell, run passwd and set a new password.
6. Type exit or reboot to restart normally.

This method is less reliable because some system configurations still enforce authentication in rescue mode. Use it only when Method 1 fails (e.g., if the init=/bin/bash trick triggers a kernel panic due to missing drivers).

Method 3: Live USB Chroot (Works Even with Broken Bootloader)

If GRUB is damaged or you cannot access the boot menu, use a Kali live USB. This method also works if the root filesystem is encrypted with LUKS (provided you know the LUKS passphrase).

1. Boot from a Kali live USB or any Linux live environment (Ubuntu, SystemRescue, etc.).
2. Open a terminal and identify the root partition of your installed Kali system: lsblk or fdisk -l. Look for the partition mounted at / in your installed system (often /dev/sda2 or /dev/nvme0n1p2).
3. If the partition is encrypted with LUKS, unlock it first:
   cryptsetup luksOpen /dev/sda2 kali-root (enter your LUKS passphrase). The decrypted device will appear as /dev/mapper/kali-root.
4. Mount the root partition to /mnt:
   mount /dev/mapper/kali-root /mnt (or mount /dev/sda2 /mnt if unencrypted).
5. Mount the /boot partition if it exists separately (usually /dev/sda1):
   mount /dev/sda1 /mnt/boot
6. Bind mount necessary virtual filesystems:
   mount --bind /dev /mnt/dev
mount --bind /proc /mnt/proc
mount --bind /sys /mnt/sys
7. Chroot into the installed system:
   chroot /mnt
8. Now you are inside the system as root. Change the password with passwd.
9. Exit the chroot: exit
10. Unmount everything: umount -R /mnt (the -R recursively unmounts all bind mounts).
11. Reboot (remove the live USB) and log in with your new password.

What If the Disk Is Fully Encrypted with LUKS?

If you enabled full-disk encryption during Kali installation (the default for many netinstall or encrypted LVM setups), you must enter the LUKS passphrase at boot before the system even starts. The methods above still work—you just need to provide that passphrase. If you have forgotten the LUKS passphrase, there is no way to reset it without losing all data. LUKS is designed to be unbreakable without the passphrase. The only option is to reinstall Kali from scratch. This is a good reminder to store your LUKS passphrase in a password manager or a secure offline backup.

After Resetting: Secure Your Account

Once you regain access, consider these steps:

• Add a non-root user: Kali runs as root by default, which is convenient for pentesting but dangerous for daily use. Create a regular user with adduser and use sudo for elevated commands.
• Set a strong password: Use a passphrase of at least 16 characters with mixed case, numbers, and symbols.
• Enable automatic updates: Run apt update && apt upgrade -y to patch any vulnerabilities.
• Consider disk encryption: If you didn’t enable LUKS earlier, you can encrypt your home directory or the entire disk using cryptsetup and LVM. This protects your data if the laptop is stolen.

Why Not Just Reinstall?

Reinstalling Kali wipes all tools you may have installed, custom scripts, and configuration files. Resetting the password preserves your environment. If you have the disk space, create a full system backup with dd or Clonezilla before attempting any recovery—just in case something goes wrong.

If you're ever locked out, try Method 1 first—it's the quickest. If that fails, move to Method 2 or 3. I'd recommend booting up a VM and running through each method once, so when it happens for real, you're not fumbling with GRUB parameters under pressure.