The shadow file is a protected Unix-like system file, commonly /etc/shadow, that stores password hashes and account-related fields such as password-aging limits. Unlike the public account database, it is normally readable only by privileged processes or administrators, helping prevent ordinary users from obtaining hashes for offline password cracking.
Authentication software may consult this file when checking a local account password, including during SSH password logins. A shadow-file entry can also indicate that an account is locked or has an expired password, though exact behavior depends on the system’s authentication configuration. Defenders should restrict file permissions, monitor unexpected changes, and protect backups; attackers who gain privileged access may copy hashes and attempt to crack them offline.