Find Linux User Account Creation Date
You can find a Linux user account’s creation date by inspecting the filesystem metadata of the user’s home directory or the /etc/passwd entry, though the exact method depends on your filesystem and what you need. The most reliable approach is to use stat on the home directory or the user’s entry in /etc/passwd, but be aware that the creation date is not always stored directly. This article explains the practical methods, their limitations, and how to interpret the results.
What Does “Creation Date” Mean on Linux?
Linux doesn’t have a single, universal “user creation date” field like some operating systems. The user account is defined by entries in /etc/passwd (and /etc/shadow for passwords), but these files don’t record when the entry was added. Instead, you have to infer the creation date from filesystem metadata, which varies by filesystem type.
- Ext4 (the default on many distributions) records a file’s birth time (also called
crtimeorbtime) in the inode. - XFS and Btrfs also support birth time.
- FAT/exFAT and older filesystems may not store creation time at all.
For most users, the home directory is created when the user is added (via useradd or similar), so its birth time is a good proxy for the account creation date.
Method 1: Using stat on the Home Directory
The simplest way is to check the home directory’s birth time:
- Find the user’s home directory:
grep username /etc/passwd(or usegetent passwd username). - Run
stat /home/username. Look for theBirth:line. If it shows a date, that’s the directory’s creation time.
Example output (abbreviated):
File: /home/alice Birth: 2023-04-12 14:32:01.123456789 +0000
If the Birth field is empty or shows -, your filesystem doesn’t support birth time, or the directory was not created on this filesystem (e.g., it was copied from another drive).
Method 2: Using debugfs (Ext4 Only)
If stat doesn’t show birth time, you can use debugfs to read the raw inode data. This requires root privileges and careful handling.
- Find the device containing the home directory:
df /home/username(e.g.,/dev/sda1). - Find the inode number:
ls -i /home/username(the first column is the inode number). - Run
sudo debugfs -R 'stat <inode_number>' /dev/sda1. Look forcrtime:in the output.
Example:
crtime: 0x5f5e0d30:0x00000000 -- Mon Sep 14 15:30:40 2020
This method is more reliable but requires root access and the filesystem must be ext2/ext3/ext4.
Method 3: Checking /etc/passwd File Metadata
If the user’s home directory was created separately (or doesn’t exist), you can check the birth time of the line in /etc/passwd itself. However, this file is modified whenever any user is added or removed, so the birth time of the file doesn’t tell you when a specific user was added. It only tells you when the file was first created, which is usually at system installation. This method is mostly useful for finding when the system was set up, not the user.
Limitations and Common Pitfalls
- Filesystem support: Not all filesystems store birth time. If you’re on a filesystem like ZFS (which does support it) or NFS (which may not), results vary.
- Home directory moved or recreated: If an admin deletes and recreates a home directory, the birth time changes. Also, if the user’s home is on a different filesystem than the system, check that filesystem.
- Useradd with no home: Some system accounts (like
daemon) have no home directory, so this method fails. In that case, you might look at the/etc/shadowfile’s last change field (the third field) which is the date of the last password change, not creation. - Distro differences: Some distributions may create the home directory lazily (e.g., on first login) or use a different path (e.g.,
/home/domain/user). Always checkgetent passwdfor the actual home.
How to Choose the Right Method
Start with stat because it’s quick and non-root. If it shows a birth time, use that. If not, try debugfs if you have root and an ext filesystem. If you don’t have root, you can’t reliably get the creation date—there’s no user-level command that reveals it without filesystem support.
For a one-off check, stat is enough. For auditing many users, consider a script that loops through /etc/passwd and runs stat on each home directory.
Alternative: Using the Shadow File’s Last Change
If you’re only interested in when the password was last changed (which often coincides with account creation), look at the third field in /etc/shadow. It’s the number of days since January 1, 1970 (epoch). Convert it with:
date -d "1970-01-01 + N days"
This is not the account creation date, but it’s a useful fallback if the home directory method fails.
Frequently Asked Questions
Why does stat not show a birth time?
Your filesystem doesn’t support birth time, or the file was created before the filesystem was upgraded to support it. For example, if you migrated from an older ext3 filesystem to ext4, the birth time may be missing.
Can I find the creation date of a user who never logged in?
Yes, if the home directory was created at account creation (which is typical for useradd -m), the birth time of that directory is your best bet. If the user has no home, you can’t reliably determine it.
Is there a command like chage that shows creation?
No. chage shows password aging information, not account creation. The closest is the last password change date, which is not the same.
Does the creation date change if I modify the user?
No, modifying /etc/passwd or /etc/shadow doesn’t change the birth time of the home directory. However, changing the home directory path (via usermod -d) may create a new directory, resetting the birth time.
How accurate is the home directory birth time?
It’s accurate to the second if the directory was created on a filesystem that records birth time. But if the admin used useradd without -m and later created the directory manually, the birth time reflects that later creation.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.