Pwconv

pwconv is a Unix-like utility that converts systems from storing password hashes in /etc/passwd to using a separate shadow password file, /etc/shadow. The conversion enhances security by restricting access to password hashes to privileged processes and users. After the conversion, the password field in each /etc/passwd entry is replaced with a placeholder (commonly x), while the corresponding hash is moved to /etc/shadow with restrictive permissions.

Pwconv is part of the shadow password utilities, typically provided by the shadow (or related loginutils) package on many Linux distributions and Unix-like systems. The command generally requires root privileges to modify system authentication files. It may also coordinate with related files such as /etc/gshadow for group passwords. During operation, it performs a consistency check and updates the relevant entries; if an entry cannot be processed, it may skip that user while continuing with others.

Reverting a conversion is possible with the companion utility pwunconv, which restores password hashes to /etc/passwd and rebuilds or recreates /etc/shadow as appropriate for the distribution. The exact behavior of pwunconv can vary between implementations.

Security and compatibility notes: shadow password schemes reduce exposure of password hashes by improving access controls and reducing the amount of information readable from /etc/passwd. Some PAM modules and authentication tools depend on shadow-style passwords, so compatibility with the shadow suite is common on modern systems.

See also: /etc/passwd, /etc/shadow, pwunconv, shadow passwords, PAM, /etc/gshadow.