Is It Safe to Keep Your Router’s Default Password?
The password on the sticker is a starting point, not a security plan. Here is why to change both.
No. Change both default passwords on your router: the admin password and the Wi-Fi password. Default admin logins are often published online, and malware tries them automatically. A unique Wi-Fi password on the sticker is better than a shared one, but anyone who sees the sticker can read it.
The two passwords on your router
The FTC says to reset both:
- The Wi-Fi password lets devices join your network.
- The admin password opens the router’s settings. The FTC warns a hacker with admin access could change settings, including your Wi-Fi password.
From the team behind this checker
Want a router that takes this seriously by default?
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site and grades its own router by the same method.
Why defaults are dangerous
They are easy to find. CISA says default credentials may be readily available online or even printed on the device.
CISA says Mirai used just 62 common default logins to break into devices, mostly home routers, cameras and video recorders. In 2024, the FBI and NSA reported that Russian military intelligence used default credentials to get into routers it used for spying.
Is the sticker password safe?
It beats a shared password, but change it anyway. Anyone who can see the router, such as a guest or previous tenant, can read it.
Rules now push makers away from shared defaults:
- California’s connected device law, in force since January 1, 2020, accepts a unique preset password, or making users set a new one first, for devices that can be logged into from outside the local network.
- The UK has banned universal and easily guessable default passwords on consumer connectable products since April 29, 2024.
- CISA urged all technology makers in December 2023 to eliminate default passwords.
How to change them
- Log in using the address and login on the label. On Xfinity gateways, the username is admin and the password is on the sticker.
- Change the admin password first. The FTC says to change the admin username too, if allowed.
- Change the Wi-Fi password and name. Avoid your name, address or router brand.
- Reconnect your devices with the new Wi-Fi password.
- Save both in a password manager, as the NSA recommends.
What makes a strong password?
Length and uniqueness. The FBI recommends a unique, random admin password of 16 to 64 characters, with no reuse. The NSA recommends a Wi-Fi passphrase of at least 20 characters.
Do new passwords stop every attack?
No. They stop password guessing, not software flaws. The FBI says TheMoon malware infects routers without any password.
Keep firmware updated and follow our router security checklist. You can also check your router’s grade to see if your model has known flaws.
Frequently Asked Questions
It is better than a shared password but still worth changing, since anyone who sees the sticker can read it. The FTC recommends changing both the Wi-Fi and admin passwords.
Yes. They protect different things. CISA says default admin credentials may be readily available online, and the FTC warns admin access lets someone change all your settings.
A factory reset restores the default login, so you can get back in. Change the default password again right away.
In some places, shared ones are. The UK banned universal default passwords on consumer connectable products from April 29, 2024. California’s law, in force since January 1, 2020, accepts a unique preset password or a forced password change for many connected devices.
The FBI recommends 16 to 64 random characters for your router admin login. The NSA recommends at least 20 characters for your Wi-Fi passphrase.
Sources
Dates show when each source was published or when we checked it.
- FTC Consumer Advice: How To Secure Your Home Wi-Fi Network (December 2022, checked October 7, 2026)
- CISA: Home Network Security (February 1, 2021, last revised March 23, 2023)
- CISA Alert TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets (October 14, 2016, revised October 17, 2017)
- FBI, NSA, US Cyber Command and partners: Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations (JCSA-20240227-001) (February 27, 2024)
- CISA Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords (December 15, 2023)
- California SB-327, Information privacy: connected devices (Civil Code 1798.91.04) (chaptered September 28, 2018, operative January 1, 2020)
- GOV.UK: Regulations: consumer connectable product security (in effect April 29, 2024, checked October 7, 2026)
- FBI IC3 PSA I-050725-PSA: Cyber Criminal Proxy Services Exploiting End of Life Routers (May 7, 2025)
- NSA Cybersecurity Information Sheet: Best Practices for Securing Your Home Network (February 22, 2023)
- Xfinity Support: Use Bridge Mode on your wireless gateway (checked October 7, 2026)
CHECK YOUR ROUTER
See how your router scores
Get its FCC status, CVEs, grade and an action plan.
Check a Router → Top 10 Safe Routers