Why Default Admin Passwords Are Dangerous
Default credentials for every consumer router are public. Database sites like routerpasswords.com list hundreds of brand/model/username/password combinations. Automated scanners hit home routers constantly looking for default logins to do one of three things:
- Change DNS to redirect you to phishing sites — the most common attack
- Add your router to a botnet for DDoS attacks
- Log traffic or inject ads into every site you visit
If someone malicious connects to your Wi-Fi guest network or compromises a smart-home device, default admin credentials let them take over the whole network in seconds.
Two Different Passwords to Change
Don't confuse these — they're different things:
- Wi-Fi password — what devices use to connect to your wireless network
- Admin password — what you use to log into the router's settings page
This guide is about the admin password. For the Wi-Fi password see Change Your Wi-Fi Password.
Step 1: Find Your Router's Admin Page
Connect to your home Wi-Fi or plug in via Ethernet, then open a browser to your router's IP address:
| Brand | Admin URL |
|---|---|
| Netgear | http://routerlogin.net or http://192.168.1.1 |
| TP-Link | http://tplinkwifi.net or http://192.168.0.1 |
| ASUS | http://router.asus.com or http://192.168.1.1 |
| Linksys | http://myrouter.local or http://192.168.1.1 |
| D-Link | http://192.168.0.1 |
| Xfinity (Comcast) | http://10.0.0.1 |
| AT&T Gateway | http://192.168.1.254 |
| Verizon Fios | http://192.168.1.1 |
| Eero | Eero mobile app only (no web page) |
| Google Nest Wi-Fi | Google Home app only |
| Ubiquiti UniFi | http://unifi or local controller URL |
Step 2: Log In With the Current Password
Default credentials on the factory sticker, or common defaults below. If you previously changed the password and forgot it, you'll need to factory reset the router — see Factory Reset Router.
| Brand | Default username | Default password |
|---|---|---|
| Netgear | admin | password (older) or on sticker |
| TP-Link | admin | admin or on sticker |
| ASUS | admin | admin or set during first setup |
| Linksys | admin | admin or blank |
| D-Link | admin | blank or admin |
| Xfinity (Comcast) | admin | password |
| AT&T Gateway | — | 10-digit Access Code on sticker |
Step 3: Change the Password (Per Brand)
Netgear
Advanced → Administration → Set Password. Enter the old password, then new password twice. Click Apply. Enable password recovery with security questions if offered — it's useful later if you forget.
TP-Link (modern firmware)
Advanced → System Tools → Administration → Account Management. Enter old password and new password twice, save. Some older TP-Link models: System Tools → Password.
ASUS
Administration → System tab. Fields for Router Login Name and Router Password. Change both if you want (many keep "admin" as the name). Click Apply.
Linksys (modern Linksys Smart Wi-Fi)
Log into your Linksys account → Connectivity → Basic → Router Password. Change, save, and re-login.
D-Link
Tools → Admin. Enter new admin password and confirm, save.
Xfinity/Comcast xFi Gateway
xFi app → More → My Services → Advanced Settings → Change Admin Tool Password. On the web admin: Gateway → System → Change Password.
AT&T Gateway
The sticker shows an "Access Code" which acts as the admin password. It's strong by default (10 random digits) and can't easily be changed without calling AT&T. Keep the sticker somewhere safe and photograph it. Don't share the code publicly.
Verizon Fios
Advanced → Change Admin Password. Enter current password (default on sticker) and new password.
Eero
Eero doesn't have a traditional admin password — your Eero account (email + password) manages the network. Change your Eero account password via the mobile app → Account → Change Password. Enable two-factor authentication there too.
Google Nest Wi-Fi / Google Wi-Fi
Like Eero, admin access is through your Google account via the Google Home app. Secure your Google account with a strong password and 2FA; there's no separate router password.
Ubiquiti UniFi
Settings → Admins → edit your admin account → change password. Enable 2FA. Create individual admin accounts instead of sharing one.
What Makes a Strong Router Admin Password
- 16+ characters if remembered; 20+ if stored in a password manager
- Mix of uppercase, lowercase, numbers, and symbols
- Not used anywhere else
- No personal information (birthdays, pet names, addresses)
- Store in a password manager so you don't lose it
What to Do After Changing the Password
- Log out and log back in with the new password to confirm it works
- Write it down and/or save it in a password manager
- Enable 2FA or security questions if the router supports them
- Check that "remote management" is disabled (Settings → Administration)
- Update firmware while you're in the admin interface
- Consider using this session to run the full router hardening checklist
If You Forgot the Admin Password
There's no recovery for most consumer routers — you have to factory reset and set up from scratch. See Factory Reset Router. Before resetting, note down current Wi-Fi settings and port-forwarding rules so you can restore them.
Exceptions: some ASUS and Netgear routers support password recovery via security questions set during setup. If you answered those, you can recover via the admin login page.
Frequently Asked Questions
Do I need to change the router admin password?
Yes — it's the single most important router security step. Default credentials are public and constantly scanned for. Changing it blocks nearly all automated attacks against your router.
What's the difference between the Wi-Fi password and the admin password?
The Wi-Fi password lets devices connect to your wireless network. The admin password lets you log into the router's settings. Both should be strong, and they should be different.
What if I forgot my router's admin password?
For most consumer routers, factory reset is the only option — it erases all settings and restores factory defaults. Note down your current configuration first (Wi-Fi name/password, port forwards) so you can restore them. Some routers support security-question-based recovery if you set it up.