How to set a password on the Xiaomi router: Wi-Fi protection and admin panel

An open Wi-Fi network is like an unlocked door to your home, and it can not only steal traffic, but also intercept personal data, infect devices with viruses or use your router to attack other networks. Xiaomi routers (Mi Router, AX3000, AX6000, etc.) often come with a factory password, such as admin or no control panel protection at all. Even if you have already set a password for Wi-Fi, this does not guarantee complete security.

In this article, we will discuss all the layers of protection of the Xiaomi router, from basic password settings on Wi-Fi to complex measures to prevent hacking. Particular attention will be paid to typical user errors (for example, using a password 12345678 or a network name as a key), which negate any security efforts, and also tell you how to reset your password if you forgot it, and what settings should be changed after you buy a new router.

If you've never gone to the router control panel, don't worry. The process is easier than it sounds: Xiaomi offers an intuitive interface in Russian, and for most models there is a Mi Wi-Fi mobile application (formerly Mi Home), the main thing is not to miss critical steps that many forget about, such as disabling remote access to the control panel or updating the firmware to the latest version (old versions of the software had vulnerabilities that allowed you to hack the router in a few minutes).

If your router has already been hacked (for example, you notice unknown devices on the network or redirects to strange sites), simply changing your password will not be enough, in which case you will need a complete reset and flashing the device, but about everything in order.

1.Preparation: What to Know Before Setup Your Password

Before you start changing passwords, make sure you have:

• 📱 A smartphone or computer connected to a router (by cable or Wi-Fi). If you have forgotten your Wi-Fi password, connect via the LAN- port.
• 🔌 Initial login data: The factory login/password for the control panel is usually listed on the sticker at the bottom of the router (e.g., admin/admin).
• 🔄 Backup of settings (optional). If you have previously configured a router, export the configuration to a file via Settings → System → Backup.
• ⚡ Power stable. Don't disconnect the router from the outlet when you change your settings, it can cause a crash.

Note that if you bought a used Xiaomi router, the first thing you do is reset to factory settings. The previous owner could leave the back door to access your network. To reset, press and hold the Reset button (usually hidden in the hole on the back) for 10-15 seconds until the indicators start flashing.

Another important point is that the Wi-Fi password and the router control panel password are two different things: the first protects your network from connecting third-party devices, the second protects your network from changing your router settings. On Xiaomi Mi Router 4A models and older, the control panel has no password at all, it can be opened from any device on the local network, and this is a critical vulnerability that needs to be fixed first.

2.Set password to the control panel of the router

The router's web interface is the brain of the device, and if an attacker accesses it, they can redirect your traffic, change the DNS- servers, or even block you. Many Xiaomi models default to password-free entry, or use the standard admin/admin pair.

To set a strong password:

1. Open your browser and type in 192.168.31.1 (or miwifi.com for new models).
2. Enter your factory login and password (see the sticker on the router). If it only asks for a password, try admin.
3. Go to System → Device Management (or Settings → Password on old firmware).
4. Create a complex password (recommendations below) and save the changes.

Password requirements for the control panel:

• 🔐 At least 12 characters long (preferably 15+).
• 🔤 Combination of letters of different registers, numbers and special characters (e.g.!@#$%).
• 🚫 Do not use personal information (dates of birth, names, Wi-Fi network name).
• 🔄 Change your password every 3-6 months (remind yourself in your calendar).

Once you save your password, the router can reboot. Don't worry, that's okay. Now, you'll need to enter a new password the next time you log in to the control panel.

3.Setting a password for a Wi-Fi network

Wi-Fi password protects your network from connecting any third-party devices, and even if you already set it when you first connected, it's worth checking the reliability and updating if necessary. On Xiaomi routers, this is done via the web interface or the Mi Wi-Fi mobile application.

Instructions via web interface:

1. Go to the control panel at 192.168.31.1.
2. Go to Settings → Wi-Fi (or Wireless mode on older models).
3. In the Wi-Fi Password field, enter a new key. For 5 GHz network, the password can be set separately.
4. Choose the encryption type: WPA2-PSK or WPA3-PSK (the latter is more reliable, but not all devices support it).
5. Save the settings and wait for the router to restart.

Recommendations for choosing a password for Wi-Fi:

If you have a dual-band router (like the Xiaomi AX3000), make sure the passwords for 2.4 GHz and 5 GHz networks are the same.This will make it easier to connect devices that automatically switch between bands (like smartphones or smart speakers).

💡

To remember your password, write it down in your password manager (like KeePass or Bitwarden) or on a piece of paper that you keep safe. Don't send your password to SMS or messengers!

4. Additional security measures

Set your password is just the first step, and to really protect your Xiaomi router from hacking, do a few more things:

1. Disable remote access

Some models have the default control panel enabled from the Internet, which is convenient if you need to set up your router remotely but it's extremely insecure. Turn it off in System → Remote Management.

2. Update firmware

Older versions of Xiaomi router software had critical vulnerabilities (e.g., CVE-2021-27561, which allows you to bypass authentication). Update the firmware through Settings → System → Software Update. If the automatic update does not work, download the firmware from the official Xiaomi website and download it manually.

3. Change the standard IP- address

By default, Xiaomi routers use IP 192.168.31.1. Attackers know this and can try to find a password at a standard address. Change it to a non-standard one (for example, 192.168.55.1) in the Network → LAN section.

4. Enable filtering by MAC- addresses

This is not a panacea (MAC- addresses can be faked), but it will add an extra barrier. Allow connection only for known devices in Settings → Wi-Fi → MAC filter.

5. Turn off WPS

WPS (Wi-Fi Protected Setup) is convenient for fast connectivity, but is vulnerable to brute force attacks. Turn it off in your wireless network settings.

5 How to Reset Your Password If You Forgot It

If you forget your password from your control panel or Wi-Fi, there are two ways to recover:

Method 1: Reset via Reset button

1. Find the Reset button on the back of the router (usually in the recess).
2. Take a paper clip or toothpick, press and hold the button for 10-15 seconds until the indicators start flashing quickly.
3. The router will reboot and return to factory settings, and you can now log into the control panel with a standard password.

Method 2: Recovery via Mi Wi-Fi (if your Xiaomi account is tied)

1. Open the Mi Wi-Fi app on your smartphone.
2. Select your router from the list of devices.
3. Click Forgot Password? and follow the instructions (confirmation via Xiaomi account is required).

⚠️ Warning: Once you reset, all of your personal settings (including Wi-Fi passwords, guest network, parental controls) will be lost. If you had a configuration backup, it can be restored through System → Backup.

If the reset didn’t work (for example, the router doesn’t respond to the Reset button), a software error may have occurred, in which case you will need to flash through the TFTP- server (see the instructions for a specific model on the 4PDA or Xiaomi Community forums).

6. Frequent mistakes and how to avoid them

Even experienced users sometimes make mistakes when setting up router security, and here are the most common:

1. Use of weak passwords

Passwords like 12345678, password or qwerty are broken in seconds, and you can check your password on Security.org.

2. Storage of password in plain form

Don’t leave your password on a sticker under your router or in notes on your smartphone without locking. Use password managers (1Password, Bitwarden).

3. Ignoring firmware updates

Manufacturers regularly close vulnerabilities in new versions of software, and if your router has not been updated for a long time, it can be vulnerable to attacks.

4 Guest access included without restrictions

Guest network must be isolated from the main network and have a separate password, otherwise guests will be able to access your local devices (printers, NAS, smart speakers).

5. Lack of control of connected devices

Periodically check the list of connected devices in the Settings → Devices section. If you see unknown MAC- addresses, change the Wi-Fi password immediately.

💡

The most common mistake is using the same Wi-Fi password and control panel, so if an attacker hacks into Wi-Fi, they can access all the router settings!

7.Security check after setup

After setting passwords and changing settings, it is recommended to check how well your network is protected.

1.Vulnerability test

Use online services like ShieldsUP! (from Gibson Research) to check if your router’s ports are open to the Internet. All ports except those needed (for example, for a VPN or P2P) should be closed.

2. Network scanning for unknown devices

Applications like Fing (for Android/iOS) or Advanced IP Scanner (for Windows) will show all connected devices. Compare the list to your gadgets - extra MAC- addresses may indicate hacking.

Verification of speed and stability

If Wi-Fi has become slower since changing your password, you may have chosen an incompatible type of encryption (e.g., a different type of encryption). WPA3 For older devices, try to return them. WPA2-PSK.

4.DNS leak test

Go to the DNS Leak Test site and run the advanced test. If your provider's DNS- servers are visible in the results instead of Cloudflare (1.1.1.1) or Google (8.8.8.8), change the settings of DNS in the Network → WAN.

💡

To quickly check if your neighbors are connected, disconnect all your devices from Wi-Fi and look at the activity indicator on the router. If it keeps flashing, someone is using your Internet.

FAQ: Answers to Frequent Questions