What should you do if you forget the background password for your Xiaomi router? If you can't enter 192.168.31.1, don't rush to reset it. I used a tool to retrieve it once

last week, I helped my mother-in-law transfer the Xiaomi AX3000T. She messed up the backend password she set last year, tried all three possible passwords, and locked the account for 30 minutes. Her first reaction was to reset, but reset meant reconfiguring all WiFi names, speed limits, and all mesh nodes. Her grandson couldn't disconnect while watching cartoons in the living room.

forced me to figure out how to recover the password without resetting, and finally I managed to use the telnet tool to get the configuration in the background. Today, if we explain this unconventional path clearly, it can save a life.

Step 1: First, determine which password you forgot

Xiaomi router has two passwords in the background, which beginners often confuse:

• WiFi password : The one you entered when your phone/computer connected to WiFi. If you forgot, you can connect the router to the router with a network cable to change the backend or reset the backend login password directly WiFi
• : Enter the administrator password you need after entering 192.168.31.1 in your browser. Forgetting is the real trouble

this article only discusses what to do if you forget your background login password. Forgetting your WiFi password is another matter (as long as your phone can still connect).

another pitfall is that the new firmware bundles the background password with the WiFi password. If you change the WiFi password, the background password will change accordingly. In this case, remember the "most recent password entered when changing WiFi"—that is the background password.

Try these three tricks first, don't reset

before disassembling the machine, try these three gentle methods:

1. to log in via Mi Home App QR code scan: The latest firmware supports scanning the Mi Home app to access the backend, avoiding password input. Open the Mijia app → Router → Settings → Background Management. You'll be given a QR code. Use another phone/tablet browser to scan the code to enter
2. reset login password (no configuration reset). : On the login page, click "Forgot Password," which will ask you to enter the phone number bound to your Xiaomi account. After verifying the SMS, you can reset the backend password, but keep all WiFi configuration and Mesh nodes __. HTML34__
3. find Xiaomi account binding records : Many people bind their Xiaomi account during the first setup but forget to check if the Mijia app → My → device → router shows if binding records are available

if all three of these moves fail, consider the next wild route.

Method: Using telnet to access the backend and get configurations

principle is simple: Xiaomi routers (AX3000T/AX6000/AX9000, etc. based on OpenWrt) have telnet debugging ports enabled by default (some firmware is blocked). After entering via telnet, you can directly read the hash file with the background password.

Specific steps:

Step 1: Prepare the tools

Connect the computer directly to the router's LAN port with a network cable (don't use WiFi, disconnecting is fine). Download two tools:

• Putty or MobaXterm (telnet client)
• WinSCP or FileZilla (convenient file transfer)

Step 2: Open the telnet port

browser access 192.168.31.1/cgi-bin/luci/; stok= Check if the page responds. The new firmware has patched this vulnerability, but some older firmware (especially those from before 2024) can still be used.

have a more straightforward method: use a dedicated tool for Xiaomi routers (such as the "Xiaomi Router Telnet Activation Assistant" on the Enshan forum). After running, it will automatically calculate the password and enable Telnet using the SN code.

Step 3: Connect the telnet

Putty, select the Telnet protocol, enter IP 192.168.31.1, port 23. After connecting, you will be asked to enter your username and password.

• username: root
• password: SN code hash calculated by the tool, or the default 6e1b8c3f of the Enshan tool

inside, it's a Linux shell that can type commands.

Step 4: Find the backend password

configuration files are generally located in /etc/config/rpcd or /etc/shadow, and their location varies depending on the firmware version. Several commonly used search commands:

• find / -name "*.conf" | xargs grep -l password
• cat /etc/config/miwifi
• cat /tmp/login (some firmware versions have this file)

find a line like password = $1$xxxx$yyyy which is the hash value. After getting the hash, run the dictionary using hashcat or John the Ripper.

the password I helped my mother-in-law recover was "abc123456"—a weak password that often appears in dictionaries, and it appeared in just a few minutes.

reset not impossible, but think carefully about the cost

if you can't handle the above, reset is the last resort. But the reset will drop these things:

• all WiFi names and passwords
• Mesh node pairing (sub-routers must be re-added),
• speed limiting rules, visitor network, child control
• DDNS configuration, port forwarding
• USB and shared disk mounting points
• Mijia binding, you need to redo it

means after resetting, you're facing a "brand new" router and have to start over. If you have many devices at home, especially those with many Mesh+ Mijia devices, a reset takes at least 2-3 hours to recover.

reset physical operation is simple:

1. the router is powered on
2. press and hold the reset port on the back with a toothpick for 10 seconds. After the indicator lights are fully off
3. release
4. wait 2 minutes to restart

after restarting, the default WiFi name will change to "Xiaomi_XXXX_XXXX" (for both 2.4G and 5G). Connect directly without a password. After connecting, 192.168.31.1 resets the login password.

daily life avoid forgetting again

the time I got my password back taught me a few painful lessons:

• Write down the password stick it on the back of the router or in the router's weak current box. It's more reliable than memorizing it in your mind
• use a password manager: 1Password/Keepass, pick any one, and enter all the router's background passwords
• binding Xiaomi account: This is the most stable backup. After binding, even if you forget your local password, you can reset it through Xiaomi account verification
• Separate the backend and WiFi passwords. : Don't set them the same, otherwise if you change the WiFi password, the backend password will follow and it'll be easier to get confused. HTML174__

here's a little trick: set your background login password to your commonly used WiFi password + the suffix "admin" or "router"—it's easy to remember and won't be forgotten exactly like your WiFi password.

to be honest: the unconventional approach above has a high barrier for beginners, and messing up can turn it into a brick rather than a loss. If you forget the background password and can't access the Mi Home app, the safest option is to reset. However, before resetting, it's best to make a list of all the WiFi names and passwords of all your connected devices at home, so you don't have to re-enter them one by one after resetting.

families with many smart home devices, it's recommended to take a screenshot of the "Device List" in the Mi Home app before resetting. It contains each device's MAC address, making re-pairing easier.