Router Default Password: Change It Before Anything Else

Sixty-one default username and password pairs were all it took. In October 2016, the Mirai botnet used those credentials to compromise over 100,000 routers and IoT devices, then knock major DNS infrastructure offline. No custom exploits. Just factory settings nobody changed.

Changing the router default password takes under five minutes. It is the single highest-return security action on any home or small-business network.

Why Router Default Passwords Are So Dangerous

Router manufacturers preset credentials to make initial setup frictionless. The username is almost always "admin." The password is usually "admin," "password," "1234," or a short string printed on the underside of the device.

That label is visible to every visitor, technician, or previous tenant who has stood near the router. Databases of default credentials for every major brand are publicly available. An attacker who knows the manufacturer, or who can see the device, does not need to guess.

Gaining access to a router's admin panel gives an attacker far more than your Wi-Fi password. They can redirect all DNS queries on your network to servers they control, pointing your browser to fake login pages for banks or email providers. They can open inbound ports to expose devices to the public internet. They can monitor all unencrypted traffic. The router sits upstream of every connected device; compromising it is as close to full network access as a remote attacker can reach.

The Verizon Data Breach Investigations Report consistently identifies credential attacks as a leading cause of breaches. MITRE ATT&CK lists default credential exploitation under the same technique family as credential stuffing. The underlying problem in both cases is the same: passwords that were never changed.

Finding Your Router's Admin Interface

Before changing anything, you need two things: the router's IP address and its current login credentials.

Finding the IP address

On Windows, open Command Prompt and run ipconfig. The value next to "Default Gateway" under your active network adapter is the router's address. On macOS, open System Settings > Network > Wi-Fi > Details > TCP/IP and read the "Router" field. On most home networks, the address is 192.168.1.1 or 192.168.0.1.

Type that address into your browser's address bar. The router's login page will load. If you have never changed the admin credentials, check the sticker on the back or underside of the device. The factory username and password are printed there.

Once logged in, find the section labeled "Administration," "System," or "Management." The path varies by brand: Netgear uses Advanced > Administration > Set Password; TP-Link uses System Tools > Admin; Asus uses Administration > System.

How to Set a Strong Router Admin Password

What makes a strong admin password

NIST SP 800-63B sets a minimum of 8 characters for general authentication. A device that controls your entire network warrants more than the minimum. Use at least 16 characters.

• Make it random, not derived from anything associated with you, your ISP, or the router brand.
• Store it in a password manager. Writing it on a sticky note next to the router defeats the point.
• Do not reuse the admin password as your Wi-Fi passphrase or any other credential.

A randomly generated passphrase works well here. Four or five unrelated common words joined with hyphens (grape-fork-cinema-tile-moss) produce a string that is long, memorable if needed, and absent from any dictionary list. Your password manager stores it; you do not need to memorize it.

After saving the new admin password, log out and log back in to confirm it works before closing the browser.

Wi-Fi Password Security: What the Settings Mean

Two passwords, two different jobs

The admin password and the Wi-Fi passphrase (PSK) protect different things. The PSK is what phones, computers, and smart home devices enter to join the network. The admin password protects the router's configuration. Changing one does not change the other.

Setting	Acceptable minimum	Stronger option
Wi-Fi PSK length	12 characters	20+ characters
Encryption protocol	WPA2 (AES/CCMP)	WPA3-Personal
SSID name	Changed from factory default	Neutral, reveals no brand or address
Admin password	Changed from factory default	16+ random characters, stored in a manager
Guest network	None	Enabled for visitors and IoT devices

A few things worth checking in the router's Wireless settings:

• Protocol selection. WPA (original) and WPA2 with TKIP have documented weaknesses. Select WPA2 with AES (sometimes labeled CCMP) or WPA3 if available.
• SSID naming. A network called "NETGEAR-2G-1234" tells anyone scanning nearby exactly which default credential database to check. Rename it to something neutral.
• PSK content. Names, birthdays, and addresses are commonly tried in targeted attacks against home networks. A random string is safer.

WPA2 vs WPA3: Which Protocol to Enable

WPA3 is the better option. Whether you can use it depends on your router and the devices connecting to it.

Why the difference matters

WPA2 uses a four-way handshake to authenticate devices. An attacker who captures that handshake packet can run an offline dictionary attack against it, testing millions of candidate passwords per second using commodity hardware. The attack succeeds or fails based entirely on how strong the PSK is.

WPA3-Personal replaces the handshake with SAE (Simultaneous Authentication of Equals). A captured SAE exchange cannot be attacked offline in the same way. The attacker would need to interact with the access point directly for each guess, making brute-force attempts orders of magnitude slower.

WPA3 was finalized in 2018. Most routers manufactured after 2019 support it, often with a "WPA2/WPA3 Transition" mode that accepts both versions simultaneously. Enable this if you have older devices that do not support WPA3 natively.

If WPA3 is unavailable, a 20-character random PSK under WPA2 + AES still provides solid protection. That length defeats offline dictionary attacks even after handshake capture.

Four More Settings Worth a Quick Audit

Updating the admin password and Wi-Fi PSK covers the most exploited weaknesses. Four additional settings close related openings and take under five minutes total.

Firmware updates. Router firmware is software, and software has vulnerabilities. Manufacturers release patches; most routers do not install them automatically. Log into the admin panel periodically and look for a firmware update option. Asus, TP-Link Deco, and Eero devices offer automatic firmware update settings. Enable them if available.

Remote management. This setting, sometimes labeled "Remote Access" or "WAN Management," allows the admin panel to be reached from outside your home. Disable it unless you specifically need it. Left on, the admin interface becomes an internet-facing login page.

UPnP. Universal Plug and Play lets devices on your network open inbound ports automatically. It is convenient and routinely abused by malware to establish persistent access. Disable it by default. If a specific application needs open ports, configure port forwarding manually for only the specific ports required.

DNS settings. The DNS addresses in your router's WAN or Internet settings control where every device on the network resolves domain names. If an attacker changed these during a period of unauthorized access, they can redirect traffic to fake pages for any website. Confirm that your DNS server addresses match your ISP's values or a recognized public resolver such as Cloudflare (1.1.1.1) or Google (8.8.8.8). Unknown addresses are a serious red flag.

What to Do Today

This is a one-time task that takes about 15 minutes.

1. Find your router's gateway IP using ipconfig on Windows or System Settings > Network on Mac.
2. Log into the admin panel with the current factory credentials.
3. Change the admin password to at least 16 random characters. Save it in a password manager.
4. Change the Wi-Fi PSK if it is still a factory default or something short.
5. Enable WPA3 if available, or confirm WPA2 + AES is selected.
6. Rename the SSID to something that does not identify your router brand or your address.
7. Enable a guest SSID for visitors and smart home devices.
8. Check for a firmware update and enable automatic updates if the option is available.
9. Disable remote management. Disable UPnP unless a specific application requires it.
10. Verify your DNS settings show familiar addresses.

None of these steps require technical background. They require 15 minutes, a password manager, and a willingness to log into a web interface that may not have been opened since the router was first installed.