Your router has two passwords, and most people only know about one of them.
The one everyone knows is the Wi-Fi password — the one you recite to guests and type into every new phone. The other is the admin login: the username and password that open the router’s settings page, where everything about your network can be changed. On a remarkable number of routers, that login is still exactly what it was in the box.
The Wi-Fi password and the admin login are two different things
The Wi-Fi password decides who can join your network. The admin login decides who can run it: rename the network, change the Wi-Fi password, see connected devices, redirect traffic, install new firmware. Most people changed their Wi-Fi password years ago — or their internet provider set a strong one for them. Far fewer ever touched the admin login, partly because many don’t know the settings page exists. Your Wi-Fi password is a separate thing from the admin login, and confusing the two is easy — it’s a distinction worth keeping straight.
On older and budget routers, the factory login is often something like admin / admin or admin / password. NETGEAR, for instance, documents admin/password as the factory default on its routers. And these defaults are no secret: CISA, the US cybersecurity agency, warns in its home-network guidance that default router credentials “may be readily available on the internet or may even be physically labeled on the device itself” — and that leaving them unchanged creates opportunities for attackers.
Who would log into your router, though?
Fair question. Your router’s settings page is normally only reachable from inside your home network, not from the open internet. An attacker can’t just type your router’s address from a café in another country.
But “inside the network” is a lower bar than it sounds. Malware on any device you own — a phone, a laptop — sits inside the network. So does anyone who has ever joined your Wi-Fi. And routers, like everything else with software, get security flaws. In April 2026, the FBI, the NSA, the UK’s National Cyber Security Centre and agencies from fifteen countries issued a joint advisory: hackers working for Russian military intelligence (tracked as APT28, or Fancy Bear) had compromised thousands of home and small-office TP-Link routers through a software flaw tracked as CVE-2023-50224, changed the routers’ DNS settings, and collected passwords and login tokens from the traffic passing through.
DNS is the internet’s phone book — it turns “yourbank.com” into the address your browser actually visits. If an attacker controls your router’s DNS, they can quietly send you to a lookalike banking page that asks for your real login. Everything looks normal, and nothing on your phone or laptop would warn you, because from their perspective they did exactly what they were told. DNS is also the reason your ISP can see more of your browsing than you think — whoever controls it sees the shape of everything you do online.
What the factory login lets someone do
Once logged into the settings page, an attacker doesn’t need any special skill beyond reading a menu:
- Point your DNS at their servers, as the campaign above did.
- Change your Wi-Fi password and lock you out of your own network.
- See every device connected to your network, and what each one is called.
- In some cases, install malicious software that lives on the router itself — invisible to the antivirus on your phone or laptop, and sometimes surviving a reboot.
The honest part is that most people would never notice any of this. A changed DNS server doesn’t make your internet slower and doesn’t show an error message. That’s exactly why the boring, two-minute fix is worth doing.
Check and change it in about two minutes
- Find your current login. Flip the router over. Most have a sticker with the admin username and password — ISP-supplied routers often have a unique one. If yours reads admin/admin or admin/password, that’s the factory default. If the sticker is illegible, your manufacturer’s support page lists the defaults.
- Open the settings page. On a phone or computer connected to your home network, type 192.168.1.1 or 192.168.0.1 into a browser’s address bar. Some brands have their own address (NETGEAR’s is routerlogin.net) — it’s usually printed on the same sticker.
- Log in with the current credentials.
- Find the admin password setting. Look under Administration, Management or System — the exact name varies by brand. (On NETGEAR it’s ADVANCED → Administration → Set Password.) Choose a long, unique password. Not your Wi-Fi password, and not one you use anywhere else.
- Save. You’ll be signed out; log back in with the new password to confirm it took.
Don’t keep the new password on a sticky note under the router. A password manager is the natural home for it — if you haven’t picked one yet, one removes the “I’ll just reuse something” temptation entirely.
Two more things worth doing while you’re logged in
Check for a firmware update. The software flaw in that 2026 advisory had been patched by the manufacturer; routers that never updated stayed exposed. CISA lists firmware updates as one of the essential home-network steps, and most routers have an update button somewhere in the administration area. If automatic updates are offered, switch them on.
Make sure remote management is off. Somewhere in the settings there may be an option like “remote management” or “allow administration from the internet”. It should be off — the settings page has no business being reachable from outside your home.
What if your router came with a unique password printed on it?
Since April 2024, UK law (the PSTI Act) has banned guessable default passwords on consumer devices — routers sold in the UK should now ship with a unique password per device, printed on the unit, or force you to set one during setup. If yours is like that, you’re already ahead of most.
Still change it. A printed password is known to anyone who can read the sticker — a visitor, a repair visit, a photo of the router’s underside shared online. And if your router predates 2024, or came from outside the UK, there’s a good chance it’s still admin/admin. Either way, a password you chose yourself is the only one that counts as yours.
Two minutes, one settings page, and the most over-trusted password in your home is finally yours.
