How do you enable SSH on a Xiaomi router? You can unlock it in five steps through the official channel, but AX3000T these new machines, you'll have to change your route

my Xiaomi R3G at home has been gathering dust for years. Last month, I found it and tried to flash OpenWrt as a side router, but got stuck at the first step: flashing requires SSH permission. While browsing old posts on the site, I found the post where I sent files to the router via SCP and got an error people still ask in the comment section, 'How do you actually enable SSH?' It looks simple, but it's actually quite a challenge—old machines and new machines are two completely different paths. When I helped unlock a friend's AX3000T, I hit a new pitfall, so I decided to clearly write both paths together.

first clarify what SSH is for—flashing your phone can't be avoided

the 192.168.31.1 backend you access on your phone or computer is like the router's 'service hall,' handling only official services you can handle. SSH is the key directly to the "data center"—once connected, you face the router's Linux system. Changing configuration files, installing plugins, viewing real logs, flashing third-party firmware all starts from here.

So, for anyone wanting to flash OpenWrt, install plugins not available in official app stores, or want to go all out, SSH is the first gateway you can't avoid. Compared to the things SSH can do, the plugins in the official app store are the difference between convenience stores and wholesale markets.

But you have to pour cold water first: enabling SSH means you have the highest root privileges, and from then on, every command you receive has no official "guardrail." Next, you have to bear the consequences of typing the wrong command. The official protocol clearly states that once SSH is enabled, the router lose its warranty . If the device is still under warranty and you just want to change your WiFi password, you really don't need this feature.

the three things to do before you start: account, device type, and psychological preparation

first step, first link your Xiaomi account to the router. No matter which path you take, you can't skip this step. Adding the router to the device list via the Mi Home app, or logging into your Xiaomi account via the web backend, counts as binding. If it's not bound, the official page won't show you the root password at all.

second item: identify which generation your machine belongs to. directly decide which path to take:

third, think carefully about the warranty and the risk of bricking. root is equivalent to voluntarily giving up the warranty; After unlocking, the firmware is randomly flashed and bricked, and the cost to recover is very high—the CR6609 posts on the site the yellow light flashing slowly after flashing the machine and AC2100 bricked and not even the light turning on The comment section is full of people holding bricks asking how to fix it, both serving as living lessons.

Official Channel for Older Models: Five Steps to Get the Root Password

my family owns the mini, R3G, and HD old machines. Congratulations, the official team has left the main entrance and doesn't use any third-party tools at all:

Step : Bind the Mi Home app to the router (as mentioned earlier). Step two open the Xiaomi Open Platform page in your computer browser at address miwifi.com/miwifi_open.html, and log in with the Xiaomi account linked to the router. Step 3 the page will directly display your machine's root password a random string of characters. Take a screenshot and save it on the spot. Login later depends entirely on it. If you forget, you'll have to revisit the page. Step 4 Download the SSH toolkit from the same page. It's a bin file (download address d.miwifi.com/rom/ssh), keep the original file name unchanged, and place it in the root directory of the USB drive. Step 5 the router is powered off. Plug the USB drive into the router's USB port, hold the SIM pin against Reset, then turn on the power. The indicator light starts flashing. Release and wait for it to finish flashing and restart.

after rebooting, verify it. Open a terminal on your computer and type:

ssh root@192.168.31.1

when prompted to enter the password, enter the root password you just captured (it's normal if characters don't appear on the screen; just press Enter after typing). Once you see the welcome message, it's considered successful. This step uses the standard SSH command. For Windows, use PowerShell; for Mac, use Terminal—it's the same. It has nothing to do with the system.

here's a pitfall I have to mention: when copying and pasting the root password, be careful not to add spaces at the beginning or end. The first time, I copied an extra space, and after several times with the wrong password, I thought the machine was locked. Also, the password is one per machine. If you have multiple Xiaomi routers at home, each has to go through its own page. Using Machine A's password to log into Machine B, no matter how you type, it's always wrong. On some older models, if the page says the toolkit is not applicable, it's usually because the firmware is too old or too new. First, update the firmware to the corresponding version on the page and try again. The complete manual upgrade process in the I wrote about firmware upgrades before.

AX3000T. New machines like BE: The official channel is dead, replaced with community tools

friend's AX3000T is much more troublesome. There are two fatal changes in this batch of new devices: first, the bodies don't have USB ports at all, so the USB flashing toolkit system doesn't exist at all; Second, new firmware versions from version 1.0.64 onward have closed early unlocking vulnerabilities, and the official open platform page no longer allows these new models. I followed the official process to step three, but the page didn't show the password at all.

the common solution in the community now is an open-source tool called xmir-patcher. Connect your computer to the router (wired or wireless) and run a script: first connect the device, enter the 31.1 backend management password, then select unlock SSH. After unlocking, change the root password to something easier to remember. the final step, "Solidify SSH," don't skip —if you don't solidify it, One factory reset or firmware upgrade can kill SSH, so you have to start over. What items are cleared out during a factory reset and how to operate them, discussed in the about factory reset. You can check before unlocking.

Also, you really need to do your homework before choosing a machine. I mentioned in the I wrote about using it for two years in AX3000T that the old V1 and V2 flashing ecosystems are mature, but the V3 version, which quietly switched chips in 2025, doesn't support OpenWrt at all; BE3600 was the same—the new platform was too new, and the community hadn't caught up yet. If you want to flash your new machine before buying, first search for model and firmware version numbers on the Enshan forum, and confirm that your unlock post is available before making a purchase.

one more piece of advice: don't rush to downgrade firmware if unlocking fails. New firmware basically prohibits cross-version downgrades. I've seen people downgrade by half, then cut power and brick directly. To fix bricks, you have to disassemble the machine and install the programmer—that's just asking for trouble. If you really want to flash your phone, it's better to spend an extra night verifying the tools and firmware versions than to rush through late at night when your mind isn't clear.

unlocked, don't rush to do these things

getting SSH access is just entering the door; inside the door is full of traps. Here are the three most common ones:

file transfers, don't take them for granted. the first thing I did after unlocking was to send firmware packages to the router via SCP. When the file exceeded 20K, it got an error. After half an overnight struggle, I realized it was a partition mounting issue. The full process is scp in the where the file transfer error occurred. If you're planning to transfer files, reading it first can save you a lot of trouble.

Don't delete the system directory randomly. root has no Recycle Bin under permission; if you type in the rm, it's really gone. If you don't understand files in directories like /etc or /lib, don't touch them. Before modifying the configuration, back up the original file—this is the rule of all trades.

do your homework before flashing OpenWrt. SSH is just the first step in flashing; choosing the wrong firmware version is the main cause of bricking. The complete process of selecting firmware before flashing, deactivating bricks, and the first thing after flashing—OpenWrt the must-read article for flashing is very thorough. I strongly recommend reading it before unlocking.

Who should unlock it, and who should avoid touching it

Here's the order to wrap up: bind your account→ confirm the model generation→ follow the official five steps for old machines, prepare community tools for new machines→ unlock → change root passwords→ new machines remember to lock → verify login→ then discuss flashing and installing plugins. Take every step steadily; this thing has no regret pill.