Password Expiry Calculator
Calculate days remaining until password expiry from PASS_MAX_DAYS and last change date.
Inputs
Days Remaining Until Expiry
28
Status
Password is valid for 28 more day(s) before expiry.
Expiry Date
2026-08-30
Days Since Last Change
62
Already Expired?
false
In Warning Window?
false
Step by step
Values used
Last Password Change Date = 2026-06-01; PASS_MAX_DAYS = 90; PASS_WARN_DAYS = 7; Evaluation Date (today) = 2026-08-02
Days remaining
days_remaining = PASS_MAX_DAYS − (today − last_change_date)
Days Remaining Until Expiry
= 28
Status
= Password is valid for 28 more day(s) before expiry.
Expiry Date
= 2026-08-30
Days Since Last Change
= 62
Already Expired?
= No
In Warning Window?
= No
How it works
Linux password aging (configured system-wide in /etc/login.defs as PASS_MAX_DAYS/PASS_WARN_DAYS, or per-user via `chage`) forces periodic password rotation by tracking the last change date in /etc/shadow. The number of days remaining is simply the maximum lifetime minus how many days have already elapsed since the last change; once that goes to zero or negative the account is treated as expired, and PAM will prompt (or block, depending on PASS_INACTIVE) the user to set a new password at their next login attempt.
Formula
Days remaining
days_remaining = PASS_MAX_DAYS − (today − last_change_date)
- M
- PASS_MAX_DAYS
- T
- today
- L
- last change date
Frequently Asked Questions
How do I check a user's password aging status on Linux?
`chage -l <username>` (as root) shows last change date, expiry date, and warning period. Non-root users can run `chage -l $(whoami)` to see their own aging info.
What's the difference between PASS_MAX_DAYS and PASS_INACTIVE?
PASS_MAX_DAYS is when the password itself expires and must be changed. PASS_INACTIVE is a grace period (in days) after expiry during which the user can still log in only to change the password; once PASS_INACTIVE also elapses, the account is locked entirely until an administrator intervenes.
Does changing PASS_MAX_DAYS in /etc/login.defs affect existing users?
No — /etc/login.defs values are only applied to newly created accounts. To change aging policy for an existing user, use `chage -M <days> <username>` directly, which updates the relevant field in /etc/shadow for that account.