Change any default password a smart device ships with during setup, choose a long password made of three random words or one from a password manager, and switch on two step verification if the device or its app offers it. Do it before the device joins your wider network.
Why defaults are risky
A default login is, by definition, known to more people than just you. If many units share the same one, an attacker can try it against every device they can find. The NCSC advises changing any default password and creating your own when you first set up a device.
Pick a strong password you can live with
The NCSC's three random words method is simple. Choose three words that have no connection to each other and join them. Its example joins apple, nemo and biro into one string. Length does the work, and the result is easier to remember than a short string of symbols.
Some rules from the same guidance:
- Avoid common passwords such as the word password itself.
- Do not use significant dates, sports teams, or family and pet names, since social media often reveals them.
- Swapping letters for lookalike characters, such as zero for the letter o, adds little because attackers know those swaps.
- Writing a password down is acceptable if you store it securely.
A password manager can generate and store unique passwords, which suits devices you only log into once a year.
A setup routine that takes ten minutes
- Unbox the device and connect it only as far as setup requires.
- Change the default password, or create the account password when asked.
- Check the app for a two step verification option and turn it on.
- Turn on automatic updates if the device supports them.
- Turn off remote access if you do not need to reach the device away from home.
- Save the password in your manager, with the model name and purchase date.
Devices with two logins
Many devices have one password for the app account and another for the device's own web page or admin screen. Change both. Routers and cameras are common examples, and the admin page is often the one people forget.
If you cannot change it
Some cheap devices have a fixed password with no way to change it. That is a reason to return the product. In the UK, regulations since 2024 require passwords on covered products to be unique per product or user defined.
Quick check
Is a long phrase better than a short complex password?
For passwords you must remember, yes. Long and unusual beats short and complex, and the NCSC recommends three random words for that reason.
Should I reuse one strong password across devices?
No. If one device leaks it, the rest are exposed. Use a different password for each.
Sources
- NCSC: Smart devices, using them safely in your home
- NCSC: Three random words
- GOV.UK: The UK product security regime
Last reviewed: 19 October 2026.
