Kali Linux Default Password (Every Image) + Reset Guide

The default username and password for Kali Linux is kali / kali — both lowercase, on every normal installer and live image since 2020. That’s the answer; if it’s all you needed, go log in. But here is the thing that trips up nearly everyone arriving from an old tutorial: the famous root / toor login is dead, and root has no password at all anymore. Not a secret one, not a blank one — root’s password is locked, on purpose, and cannot be used to log in. Kali switched to a normal non-root user in January 2020 for the same safety reasons every other Linux already had, and sudo quietly replaced the old "log in as root" habit. This guide gives you the real credentials for every flavor of Kali (installer, VM images, WSL, cloud, ARM — they genuinely differ), how to change your password, how to reset it when you’ve forgotten it, how to get a working root shell the modern way, and the one keyboard-layout trap that makes a correct password say "login incorrect."

Jake spent an hour convinced he’d installed Kali wrong. He’d followed a well-made YouTube tutorial — filmed in 2018 — that said the login was root / toor. It didn’t work. He reinstalled. Still root/toor refused. He re-downloaded the ISO, re-checked the checksum, tried a different USB stick, and started drafting a forum post titled "fresh Kali install won’t accept root password." Nothing was wrong with any of it. The tutorial was simply from before January 2020, and every guide made since the switch says kali/kali — which worked on the first try the moment he tried it. His notebook line: "I trusted the video’s confidence over the video’s date."

Ethan: "Old Kali handed every new user the master key to the building on day one — log in as root, full power, one typo from disaster. Every other Linux had stopped doing that years earlier. So Kali finally caught up: you get a normal key now (kali), and when a job needs the master key you check it out for one task with sudo, then hand it back. The root/toor login didn’t get a new password. The building manager took that key out of circulation entirely."

The default: kali / kali, and why it changed

Since the 2020.1 release, Kali ships with a standard non-root user, and on the images that carry preset credentials that user is kali with the password kali — both lowercase, no capitals, no numbers. When you install Kali yourself from the main installer, there’s no preset at all: the installer asks you to create your username and password during setup, and those are your login — there is no hidden "default" behind them. The preset kali/kali exists specifically on the ready-to-run images (live USB, the pre-built VMs) where nobody typed a password during a setup wizard.

Why the change at all? The old model — every Kali user operating as root, all the time — was a relic. It meant one careless command could wipe the system, every downloaded file ran with total authority, and beginners learned dangerous habits from hour one. Kali’s move to a non-root default (the same reason behind the "permissions do not allow pasting" error new users now hit) brought it in line with Ubuntu, Fedora, and Debian itself. Power is still one sudo away; it’s just no longer the default state you live in.

Which answer do you actually need? (thirty-second router)

Four different people search this phrase with four different problems. Match yours so you read the right section, not all of them:

• "I just booted a live USB or VM and need to log in" → kali / kali. Done — the table below confirms it per image.
• "An old guide’s root/toor won’t work" → it’s dead; the locked-root section explains what replaced it.
• "I installed Kali myself and forgot what I set" → there’s no default — jump to the GRUB reset section.
• "I’m logged in and want to change the password" → one passwd command, in the change section.

Default credentials for every kind of Kali image

This is where most pages stop at "kali/kali" and leave half their readers stuck — because the credentials genuinely differ by image type:

Two rows deserve a sentence. WSL and the self-installer have no default — if you’re hunting one, you’re hunting a credential you created and forgot, which means the reset section below is your real destination, not this table. And the old root/toor row is here only so you can recognize it in aging tutorials — if a guide tells you to log in as root/toor, that guide predates 2020, and everything else in it deserves the same skepticism.

Where did the root password go? (It’s locked, not hidden)

People search for "kali root password" expecting a value to type. There isn’t one, and this confuses even experienced Linux users: on modern Kali the root account is locked — its password field is disabled entirely, so no password can log root in, at the desktop or over SSH. This is a deliberate security posture, not a value you’re failing to find. When you need to act as root, you don’t log in as root; you become root for a command or a session:

• sudo <command> — run one command as root, authenticating with your own password (the kali user’s), not a root password.
• sudo su or sudo -i — open a full root shell for a run of admin work; type exit to step back down.
• Only if you genuinely want a root password back (rarely needed): sudo passwd root sets one and unlocks the account — but ask yourself why before you do; the lock is protecting you.

The mental shift that ends the confusion: on modern Kali, your password is the key to root, through sudo. There is no separate root password to remember because there’s deliberately no separate root login to use.

How to change your Kali password

If you’re logged in and just want to replace the default (which you absolutely should — kali/kali is public knowledge), it’s one command:

1. Open a terminal.
2. Type passwd and press Enter — no arguments needed to change your own password.
3. Enter your current password when asked (the cursor won’t move as you type — that’s normal, Linux hides password length).
4. Type the new password, press Enter, type it again to confirm. "password updated successfully" means done.

To change another user’s password (say you administer the machine): sudo passwd username. And the honest first-thing-to-do on any pre-built Kali image: change that default immediately — a machine still on kali/kali and reachable over SSH is a machine anyone on your network can walk into.

How to reset a forgotten Kali password (GRUB recovery)

This is the biggest real need behind these searches — you set a password during install and it’s gone. Because you can’t authenticate, the fix is done from outside your normal login, through the boot menu:

1. Reboot. At the GRUB menu (hold Shift during boot if it doesn’t appear), highlight your Kali entry and press e to edit it.
2. Find the line starting with linux. At its end, replace ro quiet (or add) with rw init=/bin/bash — this boots straight to a root shell with the disk writable.
3. Press Ctrl+X (or F10) to boot. You land at a # prompt, already root, no password asked.
4. Reset the account: passwd kali (or your username), type the new password twice.
5. Reboot cleanly: exec /sbin/init, or power-cycle and boot normally. Log in with the new password.

Two honest notes. This works because physical (or VM console) access to an unencrypted disk is full access — which is exactly why it’s also the argument for full-disk encryption: on a LUKS-encrypted Kali, this trick is stopped cold at the passphrase prompt, as it should be. And if you’re resetting a machine that isn’t yours, don’t — this is a your-own-computer technique, and the same door is discussed honestly for Windows password recovery with the same caveat.

"Login incorrect" with the right password? The keyboard trap

You typed kali/kali perfectly and it still says "login incorrect." Nine times out of ten it’s one of these, none of which are the password:

The keyboard-layout one is the sneaky champion, especially in VMs and on non-US laptops: the login screen echoes nothing, so a password typed on the wrong layout looks identical to you but arrives scrambled. The trick in the table — type your password into the visible username field once, read it, then clear it — exposes the mismatch in five seconds.

A note on SSH, root, and remote logins

If you’re logging into Kali over SSH and "root won’t connect," that’s two layers of intentional design, not a bug. First, root is locked as covered above. Second, even after you set a root password, modern SSH ships with PermitRootLogin restricted, so remote root is refused on top of the lock. The right pattern is to SSH in as your normal user (ssh kali@the-ip) and use sudo once you’re on. On the cloud and marketplace images, add a third layer: they usually disable password SSH entirely and expect a key — so "what’s the password" has no answer there because there deliberately isn’t one; you connect with the key pair the provider set up.

FAQ — Kali default password, answered straight

What is the default password for Kali Linux?

kali / kali (both lowercase) on live and pre-built VM images since 2020.1. On a self-installed Kali there is no default — you set the credentials during installation.

Is the Kali default still root / toor?

No — that ended with Kali 2020.1. Root is now locked and the default user is kali. If a guide says root/toor, it predates 2020 and is out of date.

What is the root password on Kali Linux?

There isn’t one — root’s account is locked. Use sudo with your own password to run root commands, or sudo su for a root shell. Set one with sudo passwd root only if you truly need it.

How do I change my Kali Linux password?

Open a terminal, type passwd, enter your current password, then the new one twice. For another user: sudo passwd username. Change the default immediately on any pre-built image.

How do I reset a forgotten Kali password?

Boot to GRUB (hold Shift), press e, add rw init=/bin/bash to the linux line, boot with Ctrl+X, then run passwd yourusername at the root prompt. Doesn’t work on LUKS-encrypted disks — by design.

Why does kali/kali say "login incorrect"?

Usually not the password: a keyboard-layout mismatch (common in VMs and non-US keyboards), Caps Lock, typing it capitalized, or it’s an installer build where you set your own credentials. Type the password into the username box once to see what really appears.

What is the default password for a Kali live USB?

kali / kali. The live image carries the preset non-root user, same as the pre-built VMs.

What are the Kali credentials in WSL?

Whatever you set the first time you launched Kali on WSL — it prompts you to create a user and password on first run. There’s no preset default to look up; if you forgot it, reset via wsl from Windows or through the distro’s config.

What’s the password on the Kali Vagrant box?

vagrant / vagrant — the Vagrant convention, not kali/kali. This trips up people who assume every image uses the same login.

Why can’t I SSH into Kali as root?

Root is locked, and SSH additionally restricts root login by default. SSH in as your normal user and use sudo. Cloud images go further and expect a key, not a password.

How do I get a root shell on Kali?

sudo su or sudo -i — both give a full root shell authenticated by your own password. Type exit to return to your normal user.

Should I change the default kali password?

Yes, immediately on any pre-built image — kali/kali is public. A default-credentialed machine reachable over the network is an open door. One passwd command closes it.

I installed Kali myself and forgot the password — what now?

There’s no default to fall back on — you created it. Use the GRUB reset steps above to set a new one; that’s the only route on a self-installed, unencrypted system.

Does the reset trick work on encrypted Kali?

No — full-disk (LUKS) encryption stops it at the passphrase prompt before any of it runs. That’s the point of encryption, and the reason it’s worth enabling on a laptop.

Is running as root on Kali ever fine?

For specific tasks via sudo, constantly — that’s the design. Living logged in as root all day is the habit Kali retired in 2020, and there’s no good reason to bring it back on a machine you care about.

What changed in Kali 2020.1 exactly?

The default user became a normal non-root account (kali) instead of root, the root account was locked, and sudo became the way to run privileged commands — aligning Kali with every other mainstream Linux. The root/toor login was retired in the same release.

Where to go next

Revision note. This page first went up in January 2020, the week Kali 2020.1 changed the default login — we were reporting the news as it happened. Six years on, the news is settled fact and the page’s job changed: not "here’s what’s new" but "here’s the complete, current answer," because old root/toor tutorials still send confused people here every day. This August 2026 rewrite covers every image type, the locked-root reality, changing and resetting, and the keyboard trap that fakes a wrong password — checked against how current Kali actually behaves. If a future release changes a default, tell us through the contact page and we’ll bring it back to true. And if you’re here because root/toor "stopped working" on a fresh install: nothing’s broken, you didn’t do anything wrong — the login just grew up, and it’s kali/kali now.