PSTI Default Passwords: What the UK’s Shared-Password Ban Means for You

Last reviewed: 1 November 2026. General information, not legal advice.

If your smart camera or doorbell uses the same password as every other one of its model, anyone who finds that password online can try it on yours. Since 29 April 2024, UK law has banned that kind of shared default password on most smart products sold to consumers. If you make, import or sell those products, a shared password can now get them stopped from sale or recalled, and get you fined.

What’s still allowed is a password that is unique to each unit, or one the user sets. That means the password printed on a label on the unit itself can be fine, as long as nobody could guess it or work it out from public information or the serial number.

The law behind this is PSTI, the UK’s security regime for consumer smart products: Part 1 of the Product Security and Telecommunications Infrastructure Act 2022, plus the 2023 Regulations made under it. Below, you’ll find where the password line sits, which products it reaches, and what to check this week.

What exactly is banned, and what’s allowed?

The Regulations put it in one line: passwords must be “unique per product” or “defined by the user of the product”. “Unique per product” means “unique for each individual product of a given product class or type”, so one password shared by every unit of a model, such as “admin”, fails.

A unique password can still fail. Passwords that are unique per product “must not be”:

1. In a sequence: “based on incremental counters”, such as “password1” and “password2” on two units.
2. Public: “based on or derived from publicly available information”.
3. Built from the serial number: “based on or derived from unique product identifiers, such as serial numbers”, unless that’s done with an encryption method or keyed hashing (a way of turning data into a code with a secret key) “that is accepted as part of good industry practice”.
4. Guessable in other ways: “otherwise guessable in a manner unacceptable as part of good industry practice”.

For the product’s hardware and pre-installed software, the rule applies while the product is “not in the factory default state”. The law defines that state as the product’s state “after factory reset or after final production or assembly”. In our reading, a password shared across units may only ever work on that hardware or software when the product is fresh from the factory or just reset, never once it’s set up.

What doesn’t count as a password here?

Three things are left out of the rule: “cryptographic keys”, “application programming interface keys” (the codes apps and services use to identify themselves to each other), and PINs “used for pairing in communication protocols which do not form part of the internet protocol suite”. In our reading, that last one covers a fixed pairing code for a Bluetooth gadget, because Bluetooth pairing isn’t part of the internet protocol suite.

Is your product’s password allowed?

Find the row that matches how your product’s passwords are made. Each answer quotes or applies Schedule 1, paragraph 1 of the Regulations.

Not sure which row you’re in? The second, third and fourth rows depend on how your factory generates the passwords, so ask whoever runs that step to show you.

Does the rule cover your product?

Probably, if it connects. The rule covers “relevant connectable products”: broadly, products that can connect to the internet, or that can connect directly to a product that does. It applies to products meant for, or made available to, consumers in the UK.

Schedule 3 of the Regulations excepts some products:

• Computers: desktops, laptops, and tablets that can’t connect to mobile networks, unless they’re designed “exclusively for children under 14 years old”.
• Medical devices covered by the Medical Devices Regulations 2002. A connectable product with medical-device software installed or running on it isn’t excepted under this heading.
• Smart meters supplied or installed by or for the holder of a smart meter communication licence or an electricity supply licence, and assured under the National Cyber Security Centre’s product assurance scheme.
• Electric vehicle charge points covered by the 2021 smart charge point rules.
• Vehicles in Great Britain: motor vehicles and their trailers, two- or three-wheel vehicles and quadricycles, and agricultural and forestry vehicles under their approval rules, excepted since 25 February 2025.
• Some products sold in Northern Ireland that already fall under EU product laws listed in the Windsor Framework.

Phones, routers, cameras, doorbells, speakers, smart TVs and connected toys aren’t on that list. So in Great Britain they’re usually covered when they connect and are sold to consumers.

Who has to comply: makers only?

No. The Act puts the duty to comply with the security requirements on manufacturers, importers and distributors alike. An importer or distributor also mustn’t make a product available in the UK if it “knows or believes” the maker has failed a security requirement. So if you resell a supplier’s camera, you can’t ignore how its passwords are made.

What happens if you get it wrong?

The Office for Product Safety and Standards (OPSS), the UK regulator that already polices product safety, enforces these rules for the government. Through it, the government can:

• Order a fix for a failure.
• Order you to stop selling a product.
• Order a recall of products already sold, as a last resort.
• Fine you up to £10 million or 4% of your qualifying worldwide revenue, whichever is greater, plus a daily penalty while the breach goes on.

The password rule is one of three security requirements. The other two are a published way to report security flaws, with the times the reporter will hear back, and a published minimum period of security updates. Each product also has to come with a statement of compliance, or a summary of it.

There’s one way round the statement duty. Since 4 December 2025, a maker is treated as meeting it if the product holds a current label from Japan’s JC-STAR STAR-1 or Singapore’s Cybersecurity Labelling Scheme. Importers and distributors must then be satisfied the label is in place.

Our guide to the PSTI statement of compliance covers what it must say.

What do makers put on their websites?

We haven’t tested anyone’s passwords. But we have checked makers’ websites for two other things this law asks for, and many makers don’t put them on their website where we could find them.

A contact or statement we couldn’t find on a website tells you nothing about a product’s passwords, and on its own it doesn’t mean a maker is breaking the law. But it’s what a buyer or a researcher sees when they look you up.

What to do this week

If you make or sell connectable products for UK consumers, and they aren’t excepted:

1. Find out how each product’s passwords are made. Check every place a password lives: the device’s own web page, its setup screen, and any service account built into the firmware. Match each one to a row in the table above.
2. Fix any shared or guessable ones in the next production run, and decide what you’ll do about units already in stock or in the channel.
3. Write down which route you rely on. You can meet the rule directly, or be treated as meeting it through one of the routes in Schedule 2 (see For engineers). Keep the evidence on file.
4. Check the other two requirements and the statement of compliance, so the whole product passes, not just its password.
5. If you import or resell, ask each supplier how their passwords are made before you list the product.

If you’d like an outside check of a product against all three requirements before a buyer or the regulator looks, we do that as a paid readiness review. Email support@securebydesignlabs.com.

If you own a smart device

A device bought before 29 April 2024 wasn’t covered by these rules when it was sold, so it may still use a shared password. If its password came from the manual or a website rather than a label on the unit, change it. If you find a security flaw in a device, our guide on how to report a security vulnerability in a smart device covers what to do when the maker gives no route.

Selling radio devices in the EU as well? EN 18031, the set of European standards listed for the EU radio rules’ security requirements, has its own self-check on whether EN 18031 applies to your device.

For engineers

The password requirement

Schedule 1, paragraph 1 of SI 2023/1007, the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, in force from 29 April 2024 (regulation 1(2)). Paragraph 1 has not been amended.

• Scope, paragraph 1(1): hardware of the product, and software pre-installed on it, “when that product is not in the factory default state”; and software not pre-installed “which must be installed on the product for all manufacturer’s intended purposes”. Unlike paragraphs 2(1)(d) and 3(1)(d), it has no limb for software “used for, or in connection with” the product’s intended purpose. In our reading, the password rule therefore doesn’t reach a companion app on the user’s phone, though the reporting and support-period rules do, unless the product is a smartphone or a tablet that can connect to mobile networks.
• Paragraph 1(2) and (3): the “unique per product” or “defined by the user” rule and the four “must not be” limbs quoted above.
• Paragraph 1(4): excludes “cryptographic keys”, PINs “used for pairing in communication protocols which do not form part of the internet protocol suite”, and “application programming interface keys”.
• Paragraph 1(5) definitions: “factory default state” is “the state of the product after factory reset or after final production or assembly”. “Good industry practice” is the skill and care expected “from a skilled and experienced cryptographer engaged in the same type of activity”. A “keyed hashing algorithm” uses a data input and a secret key “to produce a value which cannot be guessed or reproduced without knowledge of both D and K”.

Deemed compliance (Schedule 2, paragraph 1)

A manufacturer is treated as complying with the password requirement if any one condition is met:

• Condition A: it complies with provision 5.1-1 of ETSI EN 303 645 (V2.1.1), the European baseline standard for consumer internet-of-things security, and “where relevant” provision 5.1-2, applied to the paragraph 1(1) categories.
• Condition B: the product holds a current, unexpired conformance label under Japan’s JC-STAR STAR-1 scheme.
• Condition C: the product holds a current, unexpired label at any level of the Singapore Cybersecurity Labelling Scheme.

Conditions B and C were inserted from 4 December 2025 by SI 2025/1267, which also treats a manufacturer holding those labels as complying with section 9(2), the statement of compliance duty (new regulation 4A and Schedule 2A). Importers and distributors may then not make the product available “unless the importer is satisfied that the conditions specified in the regulations have been met” (section 15(5); section 22(3) is the same for distributors).

The Act

Part 1 of the Product Security and Telecommunications Infrastructure Act 2022:

• Sections 4 and 5: relevant, internet-connectable and network-connectable products. Section 54: UK consumer connectable product.
• Section 6, with Schedule 3 of the Regulations: excepted products. The vehicle exceptions in paragraphs 6 to 8 were inserted from 25 February 2025 by SI 2025/211.
• Sections 8, 14 and 21: the duties of manufacturers, importers and distributors to comply. Sections 16 and 23: no supply where the importer or distributor “knows or believes that there is a compliance failure”.
• Sections 28 to 30: compliance, stop and recall notices. Under section 30(1)(c), a recall notice needs the Secretary of State to consider that action under section 28, 29 or 42 “would not be sufficient to deal with the risks posed by the compliance failure”.
• Sections 36 and 38: penalty notices. The relevant maximum is the greater of £10 million and “4% of the person’s qualifying worldwide revenue”, and section 36(5) allows a further daily penalty of up to £20,000.

GOV.UK’s guidance on the regime names OPSS as responsible for enforcing it from 29 April 2024.

Sources and limits

• Legal texts: Part 1 of the PSTI Act 2022 and SI 2023/1007 as amended by SIs 2025/211 and 2025/1267, latest revised versions on legislation.gov.uk, read on 1 November 2026. No unapplied amendments were listed. GOV.UK guidance on the regime, last updated 2 May 2024, read on 1 November 2026.
• We name ETSI EN 303 645 only as the Regulations do; we don’t reproduce the standard.
• Our figures: SecureByDesignLabs checks of connected-device makers’ websites (21 October 2026) and of UK-facing makers’ statements of compliance (23 October 2026). We didn’t test any product’s passwords. The method and limits are on each linked page.
• Where we say “in our reading”, that’s our interpretation, not a statement of the law.

Last reviewed 1 November 2026. This is general information, not legal advice.