Which file contains the actual password hashes on modern Linux systems?

• A. /etc/passwd
• B. /etc/shadow
• C. /usr/share/dictionaries
• D. /var/log

Answer: (B)

On modern Linux systems, the actual password hashes are stored in /etc/shadow. This separation from /etc/passwd is intentional for security: /etc/shadow is readable only by root, while /etc/passwd is world-readable and contains user account information. When shadow passwords are in use, the password field in /etc/passwd typically contains a placeholder (like an x), and the real hash plus salt lives in /etc/shadow along with password aging data. The other paths listed aren’t related to password hashes: /usr/share/dictionaries is for word lists, and /var/log holds logs. Some environments use centralized authentication, but for local accounts, /etc/shadow is where the actual hashes reside.