Changing default passwords on new connected devices

Change the default password on a new connected device as the first step of setup, before you enable remote access. Many devices ship with a shared factory login that is printed on a label, written in the manual or published in online documentation. Anyone who knows that login may be able to reach the device, and devices left on factory settings are a common target for automated scanning. A new password takes a few minutes and removes one of the easiest ways into the device.

The steps below explain why factory logins are risky, how to choose and store a strong replacement, and what else to review during setup. The same approach applies to cameras, plugs, speakers, thermostats and most other connected products, although the menus differ from one product to the next, and some app-based products have no device password at all.

Why factory logins are a risk

Factory logins are often identical across every unit of the same model, which means one leaked credential can work on thousands of devices. The login may be printed on the device or the box, shared in a support forum or included in a manual that is easy to find online. Attackers who scan the internet for devices often try common default usernames and passwords, so a device that can be reached from outside your home is a more serious concern.

A simple way to judge the risk is to ask two questions. Could someone reach this device from outside your home, for example through a remote access feature? And would the factory login still open it if they tried? If either answer is yes, change the password before you finish the rest of the setup. Many devices can only be reached on your home network, which carries less risk but is not safe. A visiting guest on your Wi-Fi, or malware running on a compromised laptop, can still reach a device that keeps its factory login. A changed password makes each of these routes harder to use, so treat the default login as temporary from the moment the device arrives.

Not every product has a device password at all. Many app-based plugs, bulbs and speakers have no separate login, and access runs through the app account instead. For these, the first step is to secure that account: give it a unique password, turn on two-factor sign-in if the app offers it, and review the list of shared users and linked apps. Printed factory logins mostly apply to routers, many cameras, network video recorders and devices that serve a local web page, so check the manual to see which kind of login your device uses.

Choosing and storing a strong password

A strong device password is long, random and unique to that device. Length does more for strength than unusual characters, so a passphrase of several unrelated words, or a random string of at least 12 characters and 16 or more where the device allows, is a sound choice. Avoid words tied to the device or your household, such as the brand name, the room or a family name, because these are easy to guess.

Never reuse a password from your email, bank or any other account. A password manager is the simplest way to create, store and fill unique passwords for many devices. Save each new login with the device name and its location so you can find it later. Some devices have one login for the app and a separate one for a local web page, so look for every place a login appears and change each one.

Some devices accept only a numeric code or a short PIN instead of a password. Use the longest code the device allows, and do not reuse a PIN from a phone, a card or another gadget. If the device locks you out after several wrong attempts, follow the manufacturer's recovery steps rather than trying random codes, since repeated guessing can trigger a long lockout.

If a device has an administrator username you can change, change it as well. Some devices offer only one login, while others let you create a new account and then disable the default one. Follow the setup steps, and keep a note of what you changed so the next person who manages the device knows the current state.

What else to change during setup

Review the other settings that control access. Turn off remote access and cloud sharing features you do not need, since each one creates another path into the device. Check whether the device is controlled through a local web page, a remote service or both, and keep only the one you need. Disable public sharing links unless you have a specific reason to use them.

Many devices also offer a local option that lets people on your home network view a camera or control a plug without going through the internet. Local access is convenient, but it still needs a password, so do not leave it open just because the device is on your network. Note which features need to work from outside the home and which only need to work inside it, then switch off the ones you do not use.

Check for firmware updates before you rely on the device. Manufacturers often release fixes after a product ships, and an update can close known weaknesses. Turn on automatic updates if the device offers that option, and check the update status occasionally if it does not. Finally, remove test accounts and old linked apps that no longer need access, so the device only answers to people who should control it.