A default password is the factory-set credential that a connected device uses before its owner configures it, typically a username and password printed on a label, listed in a manual or built into the firmware. In smart home privacy, it is one of the most important weaknesses to understand, because a camera, router, hub or smart plug that still accepts its factory login can be taken over by anyone who knows or guesses it.
The risk is not theoretical. Lists of common factory logins circulate widely, and automated scanners try them against every reachable device. A smart home device that keeps its default password effectively has a publicly known key, which is why modern security standards and laws now treat universal default passwords as unacceptable.
How default passwords end up on smart home devices
Manufacturers ship devices with a preset login because the owner needs some way to reach the device for the first setup. The simplest approach for a factory is to give every unit of a model the same credential, such as admin and admin, or a blank password. This keeps production cheap and support calls easy, but it means that knowing one unit’s password unlocks every unit of that model.
The credential usually protects one of several management interfaces: a web administration page, a mobile app pairing flow, a Telnet or SSH service for technicians, or a streaming protocol such as RTSP on an IP camera. Some of these interfaces are undocumented, so owners do not know that a hidden service account exists at all and never change it.
The table below shows the main ways a factory credential is assigned and how much protection each gives.
| Assignment method | How it works | Security level |
|---|---|---|
| Universal default | Same password on every unit of a model | Very weak, publicly known |
| Blank or no password | Interface open until the owner sets one | Very weak |
| Derived from serial or MAC | Password calculated from a visible identifier | Weak if the formula leaks |
| Unique per device | Random password printed on each unit’s label | Strong if long and random |
| Forced setup | No usable login until the owner creates one | Strong |
Why default passwords threaten privacy
An attacker who logs in with a default password gains the same control as the owner. On a camera or video doorbell that means watching live video and downloading recordings. On a smart speaker hub or router, it can mean changing DNS settings, redirecting traffic or reading the list of connected devices, which reveals daily routines and occupancy patterns.
The most visible consequence is the IoT botnet. Malware families scan the internet for devices that answer on Telnet, SSH or web ports, then try a short dictionary of factory logins. A device that accepts one is infected within minutes and later used for distributed denial-of-service attacks, often without any visible sign to the owner beyond slower performance.
The harms differ by device type, as the following table summarizes.
| Device type | What an intruder can do | Privacy impact |
|---|---|---|
| IP camera or doorbell | View live video, download clips | Direct visual surveillance |
| Home router | Change DNS, open ports, read device list | Traffic monitoring, wider access |
| Smart hub | Trigger automations, unlock smart locks | Physical security risk |
| Baby monitor | Listen and speak through the speaker | Intrusion into family life |
| Smart plug or bulb | Join a botnet, toggle power | Mostly indirect, used as foothold |
Standards and laws that ban universal default passwords
Regulators now address default passwords directly. The European standard ETSI EN 303 645 for consumer IoT security makes its first provision the rule that all device passwords must be unique per device or defined by the user. It does not ban passwords in general; it bans the shared, guessable factory credential.
The UK PSTI regime, in force since April 2024, turned that principle into law for consumer connectable products sold in the United Kingdom, together with a published vulnerability disclosure policy and a stated minimum support period. In the United States, the voluntary U.S. Cyber Trust Mark label builds on comparable criteria, and the California connected device law has required unique passwords or forced setup since 2020.
| Rule | Scope | Requirement on passwords |
|---|---|---|
| ETSI EN 303 645 | Consumer IoT, European standard | Unique per device or user-defined |
| UK PSTI regime | Connectable products sold in the UK | Universal defaults prohibited by law |
| California SB-327 | Connected devices sold in California | Unique password or forced setup |
| U.S. Cyber Trust Mark | Voluntary US label | No universal defaults among criteria |
These rules apply to new products. Millions of older devices already installed still use universal credentials, and no law changes their firmware retroactively, which is why owner action still matters.
Default password compared with related protections
A default password is only one link in the chain that protects a device. Device pairing controls how a new device joins a network or app, while IoT network isolation limits what a compromised device can reach. Neither replaces a strong credential, but each reduces the damage when one fails.
- Changing the password closes the direct login risk on that interface.
- Disabling unused services such as Telnet removes hidden doors that a password change may not cover.
- Firmware updates fix hard-coded accounts that no setting can change.
- Network isolation keeps a hijacked device away from computers and phones.
Securing devices that still use a default password
The essential step is to replace every factory credential during setup, before the device is left running. A strong replacement is long rather than complex: a passphrase of at least 12 to 16 characters, unique to that device and stored in a password manager. Reusing the home Wi-Fi password or the same password across devices spreads the risk instead of removing it.
Owners also benefit from checking a few settings beyond the password. The decision table below lists common situations and the recommended response.
| Situation | Recommended action | Reason |
|---|---|---|
| New device with label password | Change it at first setup | Labels can be photographed or copied |
| Router with admin and admin login | Set a long unique admin password | Router controls the whole network |
| Camera with RTSP stream enabled | Set a stream password or disable RTSP | Streams often have a separate login |
| Device cannot change its password | Isolate or replace it | Hard-coded credentials cannot be fixed |
| Device past end of support | Plan replacement | No more fixes for known accounts |
A common mistake is to assume that a device behind a home router is safe because it is not directly on the internet. Port forwarding, UPnP and cloud relay features can expose interfaces anyway, and malware on a laptop inside the network can try default logins from the inside.
The simple explanation
A default password is like a front door key that the builder made identical for every house on the street. It is convenient when you move in, but anyone who has one copy can open all the doors.
Smart devices often come with such a shared key already set. Changing it to your own long, unique password on the first day is the single most effective habit for keeping cameras, routers and hubs under your control.
How it is used in practice
A family installs three indoor cameras, a video doorbell and a new router over one weekend. The router’s admin page still accepts the login printed in its manual, and two of the older cameras use a shared factory password for their video streams.
During setup they replace the router’s admin password with a 20-character passphrase, set unique passwords on each camera through its app, and turn off the cameras’ RTSP streams, which they do not use. The cameras and doorbell are moved to a separate guest network so they cannot reach the family laptops.
A month later, the router’s log shows repeated failed login attempts from outside addresses, which are typical automated scans. Because no factory credential remains, the attempts fail and the cameras stay private.