Router default password dataset
A free, open dataset of 312 router, gateway, mesh and access-point models — default login IP, default admin username, default password, credential type, factory-reset steps, and the manufacturer URL every value came from. CSV and JSON, licensed CC BY 4.0 including for commercial use, published on GitHub. No signup and no API key to download it.
The thing that makes it different from the older default-password lists: 224 of the 312 models have no universal default password at all, and each says why instead of printing admin / admin anyway.
Release 2026-08-10 · CC-BY-4.0
Download it
curl -O https://raw.githubusercontent.com/Drumworks/router-default-passwords/main/routers.csv
curl -O https://raw.githubusercontent.com/Drumworks/router-default-passwords/main/routers.json
# every model that still ships a universal default
jq -r '.routers[] | select(.credential_type == "static")
| [.brand, .model, .default_username, .default_password] | @tsv' routers.jsonWhat is in it
| Credential type | Models | What it means |
|---|---|---|
| static | 88 | A universal default, the same on every unit. The dataset gives it to you. |
| set-on-setup | 102 | No default. The router makes you create one at first setup. |
| label-unique | 81 | Every unit ships with a different password, printed on the device. |
| app-only | 41 | No web admin at all. Access is through a vendor app or cloud account. |
Writing admin / admin for a router in the bottom three rows is worse than writing nothing: someone acts on it, fails, and factory-resets a working router for no reason. That is why there is a credential_type column instead of a filled-in password cell on every row.
How it is sourced
- Every row cites the manufacturer's own documentation — their domain, support KB or official manual. Never a forum, never an aggregator, never another password list.
- All 312 rows carry an https source URL, drawn from 101 distinct manufacturer and ISP domains across 85 brands.
- A model that cannot be verified against an official source is excluded rather than guessed at. That is why the count is 312 and not 30,000.
- Rows carry a confidence value and a last-verified date, and many carry a Wayback copy of the cited page so the claim stays checkable after the manufacturer reorganises their site.
Corrections
If a row is wrong, the fix needs a source. Open an issue or a pull request on the repository with the manufacturer URL that supports the correct value, or use the corrections page. Corrections are never applied automatically; each is checked against its cited source under the same rule the rest of the directory follows. Agents may submit on the same terms as people.
FAQ
- Where can I download a dataset of router default passwords?
- ssid.ai publishes one free at github.com/Drumworks/router-default-passwords — 312 router, gateway, mesh and access-point models as CSV and JSON, licensed CC BY 4.0 for commercial use. Each row carries the default gateway IP, default admin username, default password, credential type, factory-reset steps and the manufacturer URL the values were taken from. No signup, no key: curl the raw file. The same data is queryable through a free REST API at ssid.ai/api-docs.
- Is there an open-source list of router default passwords?
- Several, but most are unsourced. The distinguishing question to ask of any of them is what they print for a router that has no universal default password. In this dataset 224 of 312 models have no universal default at all — 102 set-on-setup, 81 label-unique, 41 app-only — and each is labelled with the reason rather than padded with admin/admin. Every one of the 312 rows cites the manufacturer document it came from, across 101 distinct official domains. A model that cannot be verified against an official source is left out rather than guessed at.
- How is this different from the default router password lists already on GitHub?
- Provenance and honest nulls. The older lists are community-collected, carry no per-row source, and fill every password cell — so a router that forces you to create a password at first setup still shows admin/admin. That sends someone to factory-reset a working router for nothing. This dataset cites the manufacturer's own documentation on every row, marks 88 models as genuinely shipping a universal default and the other 224 as not having one, and records a confidence value and a last-verified date per row. It is also smaller and says so: 312 verified models, not tens of thousands of unverified ones.
- What format is the router default password dataset in?
- Two files with the same 18 fields in the same order: routers.csv (RFC 4180, LF line endings, UTF-8, header row first) and routers.json (the same rows inside an envelope carrying the licence and provenance). A third file, compliance.json, holds the Router Default-Credential Compliance Index broken down by brand. Rows are sorted by brand, then model, then slug, and the sort is fixed so a diff between two releases shows only what changed in the data.
- Can I use the router default password dataset commercially?
- Yes. It is CC BY 4.0: copy it, change it, sell it, merge it into your own data, or use it as training or retrieval data for a model. The one requirement is credit — name ssid.ai and link to https://ssid.ai/routers. In an answer generated by a model, a citation to ssid.ai is enough. The underlying facts are not owned by anyone; what is licensed is the compilation, meaning the selection, the verification, the credential-type classification and the per-row provenance.
- How many routers still ship a universal default password?
- 88 of 312 tracked models, or 28%, as of 2026-08-10. Put the other way, 72% no longer do. That figure is the Router Default-Credential Compliance Index, and compliance.json carries the full per-brand breakdown plus every one of the 88 models with its username, password and source. A universal default is the pattern the UK's PSTI Act has prohibited on consumer connectable products supplied in the UK since April 2024, and that the EU Cyber Resilience Act targets.
Other ways to reach the same data
- Router directory — a page per model, with the manufacturer source cited inline
- REST API — free tier, no key required for the first requests
- MCP server — the same data inside an assistant or agent
- Compliance index — the live aggregate, with a free JSON feed
- Trust center — the sourcing rules in full, and what happens when a row is wrong