MikroTik Forgotten Password: Reset the Router Without Losing Your Configuration

ByPriya Nair

Passwords can’t be recovered — but your config can be saved

RouterOS does not store passwords in a recoverable form. On any modern device running RouterOS 6.43 or later — which covers virtually all hardware built after mid-2018 — there is no command, tool, or third-party utility that can extract or bypass a forgotten password without wiping the device. The official MikroTik documentation is unambiguous on this point: the only path back in is a factory reset.

That said, “reset the router” and “lose all your configuration” are not the same thing. With the right prep work, a reset costs you about ten minutes, not a full rebuild from scratch.

Step 1 — Export your configuration before wiping anything

If you still have any access at all — a second admin account, a read-only user, Telnet, SSH, or even MAC-Winbox — do this first. Open a terminal and run:

/export file=myconfig

RouterOS writes a myconfig.rsc file to the router’s internal file system. In WinBox, go to Files and drag it to your desktop. You can also grab it via FTP if that’s enabled. Do this before touching the reset button.

The export captures almost everything: firewall rules, address lists, IP configuration, interface settings, DHCP, routing tables, PPP profiles, NAT rules, bridge configuration, queues, and scripts. Two things it does not export: user accounts with their passwords, and SSH keys. Those you’ll recreate manually after the restore — but every labelled rule, every address list entry, every NAT statement comes back automatically.

If you’re completely locked out with zero other access, skip this step. The config is gone, but the network topology is probably documented somewhere you can rebuild from. The reset is still the right move.

Step 2 — Perform the factory reset

Option A: From the terminal or WinBox (if any login works)

Open a terminal and run:

/system reset-configuration no-defaults=yes skip-backup=yes

The no-defaults=yes flag prevents RouterOS from overlaying the factory LAN/DHCP config during reset — you want a clean slate to import into, not a half-factory, half-blank mix. In WinBox the equivalent is System → Reset Configuration; uncheck “Keep Default Configuration” before confirming.

Option B: The physical reset button (for a complete lockout)

Power the device off. Hold the reset button — usually a small pinhole on the back or underside — then reconnect power while still holding it. Watch the LEDs. When the USR or ACT LED begins flashing (exactly which LED varies by model), release the button. The router reboots into factory defaults.

Default credentials after a hardware reset are username admin with no password. Some newer MikroTik units ship with a unique password printed on the device label — try that if a blank password doesn’t work.

Step 3 — Re-import your configuration

Once you’re back in, copy myconfig.rsc back to the router via WinBox Files or FTP. Then run:

/import file-name=myconfig.rsc

Watch the output. Most lines import cleanly. You’ll likely see a handful of errors on lines that reference user accounts or certificates — those weren’t in the export file and can be recreated individually. Everything else: back.

Then set your new password on the admin account:

/user set [find name=admin] password=yournewpassword

Or create a new admin user entirely if you’d rather not use the default account name.

What about Netinstall?

Netinstall is MikroTik’s network-based reinstall tool, and it has a “Keep old configuration” checkbox that sounds like exactly what you want here. There was a real exploit on older hardware: Netinstall would clear the password storage while leaving the rest of the config intact.

The catch is significant. It only applies to RouterBOARDs manufactured before mid-2018, running a factory RouterOS of 6.42.12 or older. On any device upgraded to RouterOS 6.43 or later — and any modern hardware — Netinstall cannot selectively wipe passwords. It either preserves the full configuration (locked password included) or wipes everything. For most people reading this in 2026, Netinstall is not a shortcut past a forgotten password.

Check for other access methods first

Before hitting reset, run through this quick list. Any one of these can let you change the password without a wipe.

  • A second admin-level user account on the same router
  • MAC-Winbox — connects over Layer 2 without an IP address; works as long as the interface hasn’t had MAC access disabled
  • An active SSH session left open somewhere (some terminals keep sessions alive indefinitely)
  • A serial console connection on devices that expose a UART port

If any of these work, you can change the locked account’s password with a single command and skip the reset entirely.

Make this a non-issue going forward

Schedule a weekly export directly on the router so you always have a recent copy off-device:

/system scheduler add name=weekly-export interval=7d on-event="/export file=autobackup"

Also run a binary backup periodically — it captures everything in one file, including data the export misses:

/system backup save name=fullbackup

Pull both files off the router and store them somewhere else. A config file that lives only on the device you might have to reset is not really a backup.

Sources


Similar Posts