How to check smart-device factory passwords
Compare passwords across production units, check for predictable patterns and ask how they are generated. Test whether setup and reset leave a shared password usable in normal operation. Different labels alone do not establish compliance. These checks can be coordinated in China by Cambridge China Bridge.
Define the password checks before ordering
For products within scope, PSTI requires passwords to be unique per product or defined by the user. Start with our PSTI importing guide for scope and compliance documents. This guide adds practical checks of password behaviour; it does not replace that paperwork.
Ask the manufacturer to list password-protected access routes, including local administration, setup, maintenance and recovery. Record the model, firmware and required software. Put the expected behaviour and evidence into your product specification, including who controls firmware changes and password generation.
Check uniqueness across production units
Ask the inspector to select packed production units from different cartons and production runs where available. Compare supplied credentials in a restricted record, then verify that each credential works on its intended unit. Check for duplicated labels, reused passwords and credentials that also work on other units.
Unique per product means unique for each individual product of a given class or type. A sample comparison cannot establish uniqueness across the whole production population. Ask for generation and provisioning records, duplicate-detection controls and handling of reworked units. Use our electronics inspection guide for the wider operating script.
Check predictability and serial-number derivation
Unique passwords must not use incremental counters, publicly available information or guessable patterns unacceptable under good industry practice. Compare credentials with serial numbers, labels, model names and nearby units. Flag changing suffixes, reversed identifiers and other obvious transformations. Agree limited tests on authorised inspection units rather than attempting unrestricted password guessing.
Serial-derived passwords are permitted only where the encryption method or keyed hashing algorithm is accepted as good industry practice. Ask for the method, implementation review and explanation of secret-key protection where relevant. A claim that passwords are encrypted is insufficient evidence. Refer unclear designs to a security specialist; inspectors should not collect production secret keys.
Test setup and factory reset separately
The password provisions apply to hardware and pre-installed software when the product is outside its factory default state. That state includes after final production or assembly and after factory reset. Record the transition into normal use, rather than judging only the unopened device or assuming every restored factory password is automatically prohibited.
Run initial setup, change the password, restart, perform each documented reset route and repeat setup. Check whether normal operation can resume with a shared credential, whether password creation can be skipped and whether another access route bypasses it. Returning to the same acceptable unique password is not automatically a failure. Record the actual behaviour and refer uncertain state boundaries for specialist review.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Make shipment release depend on resolved findings
Keep results against the inspected unit identity, firmware, access route and starting state. Separate observed failures, untested routes and unanswered design questions. Mask passwords in general reports and keep any necessary credential record under restricted access. Ask for corrective action and repeat the affected checks on the revised production configuration.
Do not turn a successful sample demonstration into a declaration that every unit complies. Review the findings alongside the manufacturer's compliance statement and generation evidence before approving shipment. Cambridge China Bridge can coordinate factory checks through its own staff in China and arrange specialist review where the password design needs further assessment.
Frequently asked questions
Are different passwords on every label enough?
No. Verify that the credentials work as labelled, look for duplicates and predictable patterns, and review generation controls. Sample checks alone cannot establish uniqueness across all units.
Can a factory password come from the serial number?
Only if the encryption method or keyed hashing algorithm is accepted as good industry practice. Ask for technical evidence and specialist review, rather than accepting an assurance that the result is encrypted.
Must factory reset always create a new password?
The cited provisions do not require a fresh password after every reset. Check the setup transition and whether normal operation uses an acceptable unique password or a user-defined password.
What should I request before approving shipment?
Request results tied to units and firmware, generation evidence, setup and reset findings, corrective-action records and the compliance statement. Resolve failures and untested routes before release.