What does "set on first setup" mean for router passwords?
"Set on first setup" (or set-on-setup) means the router ships with no working factory default password at all — the setup wizard requires you to create your own admin password the first time you configure the device, before it's usable.
This is the safest of the common credential patterns for router defaults: there's no default to leak, guess, or find on a label, because none exists. Until setup is completed, the device typically either can't be used at all or exposes only the minimum needed to run the setup wizard itself.
This has become the dominant pattern on newer router and mesh-WiFi models specifically because it fully closes the universal-default-password risk — there's structurally nothing for an attacker (or a public list) to exploit, since the credential never existed until the actual owner created it.
The practical downside: if you factory-reset a set-on-setup router and don't remember going through the original setup, there's no "look up the default" fallback — you have to run the setup wizard again and create a new password, same as the first time.
FAQ
- How do I log into a set-on-setup router if I don't know the password?
- If you or someone else already completed setup, that person's chosen password is the only way in — there's no factory fallback. If you need a clean slate, factory-reset the device and run the setup wizard again to create a new password.
- Is set-on-setup the same as app-only?
- No, though they're both safer than a universal default. Set-on-setup can still have a web login (created during setup); app-only has no direct login at all, ever — management happens entirely through the manufacturer's app.
- Why do some routers use set-on-setup and others don't?
- Partly regulation (the UK PSTI Act and EU CRA push manufacturers toward exactly this pattern) and partly manufacturer choice — it's the strongest default-security pattern available, at the cost of slightly more setup friction than a device that "just works" with a printed password.