How to find out the token of the vacuum cleaner Xiaomi without a phone: expert guide

Owners of robotic vacuum cleaners Xiaomi and Roborock often face the desire to integrate the device into a single ecosystem of the smart home, beyond the standard Chinese cloud. To link to platforms like Home Assistant, Domoticz or to run local scripts through miio, it is critical to know the unique security identifier — token. The standard way to obtain this key lies through the official application Mi Home, which requires authorization and server binding, which is not always convenient or possible in a limited network.

However, there is an alternative and more technical approach that allows you to extract the necessary data directly, bypassing the mobile application and its limitations, this method is based on analyzing network traffic or using the local API of the device itself, if it is already connected to the network.

In this guide, we will detail how to securely obtain a token using only a computer and basic knowledge of network protocols. You will learn how to intercept handshake packets and use specialized command-line utilities to decrypt data. This knowledge will give you complete control over the device, allowing you to automate cleaning, create complex scenarios and control the vacuum cleaner even in the absence of the Internet.

Understanding the security architecture of Xiaomi Mi IoT

Before we start extracting the keys, we need to understand how Xiaomi secures its devices. The protocol of interaction is based on the principle of local encryption, where each data packet (request or response) is signed and encrypted using a unique token. Without this key, the device simply ignores incoming commands, considering them to be illegitimate.

The authorization process usually happens in the background when you first connect through an app. A mobile phone requests a token from the Xiaomi Cloud server, receiving it in response after you validate your user rights, and that's the mechanism we're trying to circumvent or emulate. Understanding that the token is stored in the device's memory and transmitted with each connection gives us the key to solving the problem.

⚠️ Note: Any manipulation of network protocols and traffic interception must be done only on your own local network.

It is important to note that different models of vacuum cleaners (for example, Roborock S5, Xiaomi Vacuum Mop or Dreame) can use slightly different versions of the miio protocol. However, the basic principle of obtaining a token remains unchanged: we need to become a “trusted” client in the eyes of the vacuum cleaner or eavesdrop on the dialogue between an already trusted device and the server.

Traffic interception method: analysis of network exchange

The most reliable way to do this, without rooting the phone or the complex firmware manipulation of the vacuum cleaner itself, is to analyze network traffic, and the method is to put the computer between the router and the vacuum cleaner (or between the phone and the router), and record the moment when the device requests or receives the token, using package sniffer software such as Wireshark or tcpdump.

The process is this: you set your computer up as an access point, or you use port mirroring on a managed switch, and then you start reconnecting the vacuum cleaner or resetting the network settings to make the device request configuration again, at which point packets containing the 32-character string are broadcast.

For successful interception, you will need:

• 💻 Computer with Wireshark installed and administrator rights.
• 📡 The ability to raise the access point with the same SSID and password that your main network has (to redirect your device).
• 🔌 Stable connection between analyzer and target device.

After packet capture, traffic must be filtered through the protocol. UDP (port 54321) seek HTTP-requests to mi.com or xiaomi.com domains. The body of the response often contains JSON-a structure where the token field will be visible in plain view unless the connection uses additional encryption SSL/TLS This is the case (which is often the case with local detection).

💡

Use the filter "udp.port ==54,321" in Wireshark to quickly navigate MiIO packets, which will significantly reduce the time you need to search for the data you need.

Use of command line utilities: Python and miio

If the sniffer method seems too complicated to you, there is an alternative based on brute force or exploiting vulnerabilities in older firmware versions, but a more modern and legal approach is to use specialized Python libraries. python-miio library is the de facto standard for working with the Xiaomi ecosystem and allows you to interact with devices at a low level.

To get started, you’ll need to install Python on your computer (versions 3.7 and higher) and set the necessary dependencies, a method that often requires the device to be already online, but not necessarily tied to your in-app account if we use local token methods. However, most often this tool is used to validate an already received token or to extract it if you have access to the Android file system (via the Android file system). ADB).

Consider the basic scenario of using a utility to verify communication. If you received the intended token in any way (for example, from an Android backup), you can check its operability with the following command:

miio --ip 192.168.1.X --token YOUR_TOKEN_HERE info

If the token is correct, the device will respond with detailed information about the model, firmware version, and current status, and if the token is incorrect, you will get a timeout error or authentication failed, a powerful tool for testing hypotheses when searching for the key.

Getting a token through Android Debug Bridge (ADB)

One of the most effective ways that doesn’t formally require “no phone” at the time of setting up, but avoids using Mi Cloud to extract the token is to access the internal Android smartphone databases. Mi Home and Roborock apps store the tokens of the tied devices in the local SQLite database on the phone.

To take advantage of this method, you do not need root access if you use debugging capabilities. USB (ADB). You plug your phone into your computer, access the application's file system (unless it's heavily protected, as you do on older versions of Android), or make a full backup of the application, which you then disassemble on your computer. miio_store.db or similarly contains a table with tokens.

The sequence of actions looks like this:

1. Enable the developer mode and debugging by USB on your Android device.
2. Connect your phone to your PC and execute the command adb backup -f mihome.ab -noapk com.xiaomi.mihome.
3. Unpack the resulting.ab archive in.tar, and then retrieve the database.
4. Open the database with any SQLite browser and find the token string for your device.

⚠️ Note: On modern versions of Android (10 and above) access to application data via ADB In such cases, the method may not work without prior preparation or use of emulators.

The good thing about this method is that it gives you a clean token that works guaranteed, because it's taken directly from the source of truth, the official customer. Once extracted, you can use this token to integrate into Home Assistant or other systems, completely disconnecting the phone from the management process.

Comparison of methods and selection of the optimal path

The choice of method depends on your technical background and the equipment available. Traffic sniffering is universal, but requires a good understanding of network technologies. ADB is easier for those who are familiar with Android development, but depends on the version of the OS. Python scripts are ideal for programmers.

Below is a table comparing the main characteristics of the methods considered:

It is worth noting that for new models of vacuum cleaners with the updated security system Xiaomi IoT old methods may work worse, in such cases, a combination of methods (for example, obtaining a token through ADB and checking through Python) gives the best result.

Integration of the token into the smart home systems

Once you've successfully mined the 32-character key, the most enjoyable step is to set up the integration. In Home Assistant, this is done through Xiaomi Miio integration. IP-the device address and the resulting token in the configuration file configuration.yaml or through the graphical interface, if the integration supports manual input.

Example configuration for configuration.yaml:

vacuum:


- platform: xiaomi_miio




host: 192.168.1.XXX




token: YOUR_32_CHAR_TOKEN




name: Xiaomi Vacuum

Once the service is rebooted, you'll have full control of the vacuum cleaner, you'll be able to start cleaning, you'll be able to dock, you'll adjust the suction power, and you'll even get a real-time map of the room, which turns a regular gadget into a fully-fledged smart home participant, able to respond to events like starting cleaning when everyone's gone.

⚠️ Note: When you change your Wi-Fi password or reconnect the vacuum cleaner to a new network, the token may change, in which case the extraction procedure will have to be repeated.

Keep in mind that local token management only works within your network. For remote access, you will need to set up port port port port port port overlay (not recommended due to security risks) or use a VPN, or leave the Home Assistant gateway accessible from the outside through secure channels.

💡

Local management via token ensures the operation of automations even when the Internet is turned off or Xiaomi servers fall, which is critical for the stability of a smart home.

Frequently Asked Questions (FAQ)

💡

Keep the token in a safe place (password manager or paper carrier) and losing it will require a repeat of the entire mining procedure, which can be a time-consuming process.