1 October 2025

Kali Linux Default Password: What It Is, Security Risks, and How to Change It Safely

Blog

Kali Linux is a powerful Debian-based Linux distribution widely used by cybersecurity professionals, penetration testers, and hackers for ethical hacking and security auditing. Designed with security in mind, Kali Linux comes preloaded with hundreds of security testing tools. However, one aspect of Kali’s default configuration often overlooked by new users is its default login credentials.

This article explores what the default Kali Linux password is, the security implications of keeping it unchanged, and provides a guide on how to safely change the default password to enhance your system’s security.

What Is the Kali Linux Default Username and Password?

For many years, the default username and password for Kali Linux were:

Username: root
Password: toor

This default combination was designed to allow users easy access to the system for fast deployments in controlled or lab environments. However, with the release of Kali Linux 2020.1, the developers shifted to a standard user model for better security. The new default credentials are:

Username: kali
Password: kali

While this may seem secure in a local, non-networked setting, using these defaults in production or on exposed systems creates considerable security vulnerabilities.

Why Default Passwords Are a Security Risk

Leaving the default password unchanged on any operating system is a considerable risk. This is particularly true for Kali Linux, which often contains sensitive tools that could be misused if access is obtained by unauthorized users. Here are the main reasons why default passwords are a significant threat:

Common Knowledge: The default credentials for Kali are publicly known and well documented across the internet. Anyone attempting unauthorized access is likely to try these first.
Privilege Escalation: A default user may have administrative privileges, allowing an intruder full access to install malware, extract sensitive data, or use the system to attack others.
Network Vulnerability: If Kali is connected to a network with the default login active, it increases the chances of being exploited by bots or malicious actors scanning for systems with weak credentials.
Loss of Data and Control: Someone gaining access to your Kali machine isn’t just a risk to your files — they might use the tools available to perform attacks on other systems, making you an unintentional accomplice.

How to Change the Default Password Safely in Kali Linux

Changing the password in Kali Linux is straightforward, but it’s essential to do so properly to avoid breaking access or permissions. Follow these steps to update the default password safely:

Step 1: Open the Terminal

Launch the terminal from your desktop environment or press Ctrl + Alt + T to open it.

Step 2: Use the `passwd` Command

Type the following command and press Enter:

passwd

You will be prompted to enter your current password and the new password. If you are logged in as kali, this command will change that user’s password.

Step 3: For Root User Password Change

If you want to change the password for the root user for administrative access, use:

sudo passwd root

Then follow the on-screen instructions to set a new password for the root account.

Step 4: Confirm Changes

Once the changes are made, log out and attempt to log back in using your new credentials to verify the update was successful.

Tips for Creating a Strong Password

When creating a new password for your Kali Linux account, make sure it is:

Long: At least 12 characters for enhanced security.
Complex: Includes uppercase, lowercase, numbers, and symbols.
Unique: Do not reuse passwords from other accounts or systems.
Memorable: Use a passphrase or memorable sentence so you don’t have to write it down.

You can also use a reputable password manager to generate and store complex passwords securely.

How Often Should You Change Your Password?

For most users running Kali in a lab or controlled environment, changing the password frequently might not be necessary. However, if you’re using Kali Linux regularly or in a professional setting, consider updating your password every few months, especially if:

The machine has internet-accessible services.
You’re using it in a shared or publicly accessible network.
You suspect a potential breach or weird behavior on the system.

Best Practices for Kali Linux Security

Aside from changing your default password, there are additional precautions you can take to secure your Kali Linux system:

Keep Your System Updated: Regularly update packages and tools to patch any existing vulnerabilities.
Disable Root Login: Use the sudo command for administrative tasks instead of enabling root login.
Set Up a Firewall: Use ufw or iptables to manage open ports and connections.
Limit Network Exposure: Avoid using Kali in a production environment or exposed network unless absolutely necessary.
Audit Installed Tools: Kali includes numerous penetration tools. Remove what you don’t use to limit potential security leaks.

Conclusion

While Kali Linux is designed to be a security-focused operating system, its default password is a glaring vulnerability if left unchanged. Whether you’re a seasoned pentester or a new cybersecurity student, changing these credentials should be your first step after installation. It’s a simple yet powerful way to prevent unauthorized access and ensure your work environment remains secure.

Remember, security starts at login. Don’t let careless configurations compromise your system integrity.

Frequently Asked Questions (FAQ)

What is the default password for Kali Linux?: As of Kali Linux 2020.1, the default username is kali and the password is also kali. Older versions used root as the username and toor as the password.
Can I disable the default user in Kali Linux?: Yes, you can disable or remove the default user, but make sure you create a new user with appropriate permissions before doing so to avoid losing access.
Is it safe to use Kali Linux for daily tasks?: Kali is tailored for penetration testing and not recommended for daily use. It contains powerful tools that, if misused, could harm your system or network.
How do I reset the password if I forget it?: You can reset the password by booting into recovery mode and using the passwd command for the affected user.
Does changing the password affect installed tools?: No, changing your password does not affect pre-installed tools or packages. It only alters login credentials for your user account.