Camera default passwords by model

What each vendor actually does

Axis

Current Axis products ship with no account at all. Reaching the device the first time presents an account creation step, you set the administrator credential there, and that is the only credential that exists. Nothing is printed on the label and nothing is published in the datasheet, by design. The root account is real and historically significant, but the reposted password pairings attached to it apply to specific discontinued products at specific firmware levels, if they were ever accurate.

One change worth planning for: AXIS OS 13 enforces a password complexity profile with a 15 character minimum that cannot be disabled. If anything in your provisioning generates camera credentials, check the generated length against that before the upgrade makes every new account creation fail at once. The full picture, including the authentication change that makes a correct password look wrong, is in Axis camera default password: what it is and is not.

Bosch

Bosch states that by default there are no passwords assigned to any of the user accounts, and that the first time any user accesses the device, the device prompts the user to set a password at the service level. The camera requires a strong password and measures the strength of what you enter.

Bosch cameras carry three inbuilt accounts rather than one, which is the detail that catches people who assume a single administrator. service is the administrative account with access to all configuration. user is an advanced account with camera control and access to live and recorded video. live is a basic account limited to the live stream. The service password is set first, at the highest access level, and the others follow.

Hanwha

Hanwha Vision documents this as an explicit design policy, under a heading that reads "No initial password": all Hanwha Vision products have no initial password and are designed so the user sets their own when accessing the product interface for the first time. The account is named admin. Their stated reasoning is that a manufacturer default a user might never change is itself the vulnerability.

The complexity rule is length-dependent. Eight characters is the minimum, and a password of eight or nine characters must combine three character types where ten or more needs only two. Cameras cap at 15 characters. Repeated failures are throttled rather than locked out permanently: five or more attempts within thirty seconds are blocked, and sessions already authenticated stay up, so the throttle cannot be used to knock an operator off a camera. The default IP address, where admin / 4321 really applies, and the reset procedure are in the Hanwha Wisenet default password post.

What a factory reset actually costs you

This is the part that turns a five minute problem into a site visit. A reset does not just clear the password, and on two of these three vendors it moves the camera to a posture that is more restrictive than the one it shipped in.

Axis. A reset returns the camera to DHCP, wipes the device certificate, drops the time configuration, and restores the current factory credential policy. On recent AXIS OS that policy is not the one an older camera was commissioned under, so a factory-defaulted camera and an identical camera upgraded in place can authenticate differently while showing the same model and firmware.

Bosch. Bosch moved to a closed-by-default posture, switching off unencrypted web access, streaming, its native control interface, local storage exposure, and the camera's own time service. On CPP13 that arrived with the firmware. On CPP14 and on CPP6, CPP7, and CPP7.3 it does not take effect on upgrade at all: it takes effect when the camera is factory defaulted. Reset one of those to clear a password and a recording system relying on unencrypted transport can stop connecting, with nothing about the password to explain it.

Hanwha. A factory reset switches off the third-party integration interfaces. The camera comes back, the credential is fresh, and the recording system still does not see it until someone re-enables them by hand.

Before you reset anything

On a camera that was already working, a rejected password is usually not a credential problem, and the reset that feels like the fast fix is the expensive one. Three things are worth ruling out first: an authentication policy that changed under the device rather than a password that changed, a throttle after repeated failed attempts, and a second account being used by a system nobody remembers configuring. The full diagnostic ladder for the first of those is in the Axis credential post, and the rotation side, where credentials get changed without breaking the recorder, is in how to rotate camera passwords without breaking your VMS.